hxxp://metabo-center[.]kiev[.]ua

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://metabo-center.kiev.ua
Sample260903-pyrlsshc94

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3324	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329130853940138"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{84CEFBEE-5FCA-4391-BEFE-5C74BD3136E3}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
2756	chrome.exe
2756	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe
Token: SeShutdownPrivilege	4272	chrome.exe
Token: SeCreatePagefilePrivilege	4272	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe
4272	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1276	4272	chrome.exe	84
PID 4272 wrote to memory of 3284	4272	chrome.exe	86
PID 4272 wrote to memory of 3324	4272	chrome.exe	87
PID 4272 wrote to memory of 3284	4272	chrome.exe	86
PID 4272 wrote to memory of 1972	4272	chrome.exe	88
PID 4272 wrote to memory of 1972	4272	chrome.exe	88
PID 4272 wrote to memory of 1960	4272	chrome.exe	89
PID 4272 wrote to memory of 1676	4272	chrome.exe	90
PID 4272 wrote to memory of 1960	4272	chrome.exe	89
PID 4272 wrote to memory of 1676	4272	chrome.exe	90
PID 4272 wrote to memory of 4136	4272	chrome.exe	91
PID 4272 wrote to memory of 4136	4272	chrome.exe	91
PID 4272 wrote to memory of 4356	4272	chrome.exe	93
PID 4272 wrote to memory of 4356	4272	chrome.exe	93
PID 4272 wrote to memory of 976	4272	chrome.exe	94
PID 4272 wrote to memory of 976	4272	chrome.exe	94
PID 4272 wrote to memory of 2848	4272	chrome.exe	95
PID 4272 wrote to memory of 4532	4272	chrome.exe	98
PID 4272 wrote to memory of 4532	4272	chrome.exe	98
PID 4272 wrote to memory of 4128	4272	chrome.exe	100
PID 4272 wrote to memory of 4820	4272	chrome.exe	101
PID 4272 wrote to memory of 2488	4272	chrome.exe	102
PID 4272 wrote to memory of 1288	4272	chrome.exe	103
PID 4272 wrote to memory of 1288	4272	chrome.exe	103
PID 4272 wrote to memory of 4328	4272	chrome.exe	104
PID 4272 wrote to memory of 4328	4272	chrome.exe	104
PID 4272 wrote to memory of 3344	4272	chrome.exe	105
PID 4272 wrote to memory of 3344	4272	chrome.exe	105
PID 4272 wrote to memory of 4904	4272	chrome.exe	107
PID 4272 wrote to memory of 1720	4272	chrome.exe	106
PID 4272 wrote to memory of 1720	4272	chrome.exe	106
PID 4272 wrote to memory of 3056	4272	chrome.exe	108
PID 4272 wrote to memory of 3056	4272	chrome.exe	108
PID 4272 wrote to memory of 2756	4272	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://metabo-center.kiev.ua
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa24b5c728,0x7ffa24b5c734,0x7ffa24b5c740
  2⤵
  PID:1276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,752224200702601938,5849873042065976392,262144 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,13248721653437964148,16071462574942131039,524288 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,6910001137962344142,1714334952746010286,524288 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,12295373434679115973,3510510116597213981,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,6059657626267125825,972110618813152002,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,11353701071667552591,13770819060860093600,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4416,i,12035620012363657955,14557295483333583656,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3912,i,2679774238560694370,3484864158395406065,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,10227946139364827695,8071831074839615514,524288 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5380,i,8473593697043515960,14902327939222414977,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,11966994621024909561,17438600022642472046,524288 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,1736571329327494450,16363047543932160020,524288 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4416,i,7435597388529726999,4462246193102496176,524288 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4836,i,9142476191913310217,9948187953255300044,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5824,i,640129779956962076,4138016907772352332,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4472,i,3098126706215330574,2444760005964456838,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,3126573622999693344,15109223558187104286,524288 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,13155848422271785047,2607842537763655255,524288 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4568,i,9266716701119493665,6155160346520242970,2097152 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=984,i,17309502529062999999,1127558434205801895,262144 --field-trial-handle=2220,i,10997496396232345392,5830312323422882581,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6efd4ae9dcf925ce2e9a9c2dfb6b3baba8edef96e7f0b08bdb9e3da986f638b3
MD5 3a4d85804ca82b59ebeebc1151b281ad
SHA1 9c7516568e10f1b4230c7e12afce801de25d4bc3
SHA512 43945a172761d2dd0375616b0293714505c8295c7bc87344b1772907d12477ba706e81db170003854daa9d2d5773d6acd1f841126a3aa9fc88a6b140dca253b8
TLSH
T1D0E022AAC831AC772DFE071C50914B06EB6513562AC1892F7B3DC60C8FB2A3A41C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 6d028721c36a564939970aad4917b7bc1ceac91bb596b8e35cffeb12606df5de
MD5 4dcbd4576857403dea4ae6e318cceb85
SHA1 55fc3e988a4621e3cb823aa9fb0cb46e09419339
SHA512 cd94607ade01e4c3d63b0142a53eb022288b0009c38da34b50413936bdf10abace8ff334837da5e5fe587855eb5a7be03f8175397a1172757801097ac75687b6
TLSH
T1AA0128147E03109DEBD715B025EE56179B620E754CED074E7308DC541977677B4062F7
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f464408c7931a440b91b7e434eb98e3fc811534aa39fd504510a827077ae2ee9
MD5 ddb074ac630d3daacbed6fbc2f7cc49a
SHA1 6554794d9140680845a792f8ccc18be2ffa36181
SHA512 fb3d05b15ba1454c816e6e0ff0cc85a8983899bf6fc8b63e831fe6956a4a75d1ad0ad932bfdbd2efd1a8daebd10036e67fc74a96a02a099ebb026334abb78726
SSDEEP 192:Dia2b7PJcRaIaaZEdhAuXudkKaPGvNfPsNPMrgCEcC:Dia2b7PJcRaIagEdhAuXudkKa+lfkNUc
TLSH
T15ED1BEF7C3E8856D89515AF8DB156F1FCE290A24431C3C66C8D8EE1B93F2872E21564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 100d6a6cc35123eb8f8c87e8480c29baa682a99312d6f653e8923bb325f3a900
MD5 b5c07c4bd95aedcef42be8192980d68f
SHA1 c7ae14bcf220326a99cd2a9ffa106fa9a9de5378
SHA512 daf8cafe047af98cbaa0762893793688d4698dfea2634bb967a19700e955ab0b1003adf1422439507c9424b8fee3fb4f09f269f5be3458a80757d997522fd93a
SSDEEP 48:YALlh5qh4hSthphJaXYfo7gmgaqskv/+sHXEdKsPtszBsNPsuNP5sEcsKJzsfJFq:Dvqa2bfaIaiam/1EdhAuvNP3+ujE
TLSH
T115919FF7C3E4856D89115AF4DB156F1FCE290A24431C3C66C8D8AE5B93F2872E21538E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 18c89c8e0679113ba042f00e6d128b3edb32ca0c226a79598f7145a4f3258ac0
MD5 f16c44a784cfe0f127a925f67542ea5d
SHA1 a17bdacfe1c5c1850c55e4f246293dea0aa18b1d
SHA512 826520e52920eb831d7c58e67b02dc7f420c93c1b4ffb4a09436f7c533aee2ba1bf3a1df52c04a51e5ea539408994a51151d3a00da9c2af78bd1a04442fbaf94
SSDEEP 192:LRQIL/zv9N3Pv7hpAPRp259y95Hsb+WNnFZPBI22/h8b+VyIsnAUge:LRQG7LH9UX0yrwnPW22/e2e
TLSH
T1AA42E72EF910693B5CCBC22AF9227753D7F6107125A02E84E7FC8A2C15EB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 71fe0118d42d48bebbcf442701f8da00be359a23b7ef9e924edf0f629d5150fb
MD5 456f25b60ce6a699b75c7392b152b277
SHA1 b0283c2ea67455acf12441a1e0be7ed98b680e33
SHA512 579e30b4b203f0a8100a0ff725ea3bfad340cab9c39c91836bfd96a59733768587f70e16a6b08d8dd2f204fbb2a2aa9297ca93d191efad10bfa4133529467f5e
SSDEEP 192:HRQIL/zv9N3B9v7hpAPRp257y95Hsb+WNniIv0VI22/h8f+VyIsnAUgE:HRQG7LB99UXOyrwic0a22/W2E
TLSH
T11742EA2EF910697B5CCBC22AF9227B57D7F6107125A01E84E7FC8A2C15EB9CD221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9e188aa318669a66b1a12fa05c67753a978949d1d4a27834fdbc37e2332c1c23
MD5 6e8cd4d99a04f73000d1f6920941deaa
SHA1 38e448543d89a894b6f5ae350777859576c84c89
SHA512 f085703485973d5e084092645eb13eb8d3f7dacfcc7dd98da270a05d55c340044f5f1af060ddf5950dd0db62c920e756c6b7bafb92a65438245c67658f240512
SSDEEP 192:HR4cBzIL/zv9NEg9v7tpAPRp2HQbu17y95Hsb+WNniIv48I12nI22/h8f+VyIsnv:HR4mzG7wg9JUXTahyrwicpq2I22/W2E
TLSH
T1BD52E82EF910697B5CCAC22AF9227B17D7F6107125A41E84E7FC8A2C15EB9CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ad0f4fadee927fd43968c7c5056370608a33cb92b0dc7ce78bca14a07872aad3
MD5 d8dcd21f9546562cf35f9cee44f807e1
SHA1 9e7e846439c6dc54e34aabdc225db126e1fa7317
SHA512 687fb94e20557161f329cef4fc67714528abf639c0bd4a81c6135c4b190e8c044e97667cbf858813e2cdaab6d9fabd26dffe81c7df30bfc6a01240a003ea6948
SSDEEP 192:HR4cBzIL2cgM/NE39v7tpJPRpBTHQbu17y95Hsb+WNniIv48I124I22/h8z+VyI4:HR4mzG/gv39J7Xiahyrwicpq2V22/w2E
TLSH
T13C52FA2EF91069775CCAC22AF9227B57D7F6107225A01E88E7FC892C15EB9CD321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 03fe44d1c35fe2637466cab3331e100833ce96779bd8a1fb5dbc72306e4ffd1d
MD5 31922c686fa4d27db9ab2d8ae0ff1521
SHA1 628f227ac225518ffd89b795eb8629ace41ce9f9
SHA512 fd2ba593fdad102370bf985c16b791a02d5d40e3202bc46a76149a7b844bad3da5aa4d8de182d10eda0829df49bb8b3d6700a140790f4779b2582422c2c0b86d
TLSH
T1E2B0128180016515C00206F415E2148871689F11A70A170583F0BD27DC371D08018170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e48f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e48f.TMP
Size 96B
SHA256 e49432fd7d06688dc19d3b3e7b23c2cad039071ba02d48a2f04b14e8f285eb75
MD5 9b102cb01c9e16138ac7d61bca23cb24
SHA1 714be98409b289aeea20995a9df0dbc5983ca526
SHA512 0ba4e2cb37772d7293a0c93d25a46b96eac328cc01d89b50a990f0330870572625dfb55c2c79b5fed4d0596eb4f6b55c52c1063ffec4b87dcb854aaa123e68e7
TLSH
T125B02202EA022322F00303B0288088CCB020CF20CA03020283E03BA2CC2222038208F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 776536a22f2dba70ab90378846fa3b4b6fcea0176e61f44c61aa7a8b3d0168fa
MD5 e58a06c497f60e19de690c27ab18d961
SHA1 09cede74553da8292bf1264a475e72b73d85db7c
SHA512 fccfb07a7b07cdb36612ed9bf9fabf4ccf2ba53a3d6c5b41b77436135e93a93061b9167116057dfa2f212212931ef8bcba1df978daf573166da52a522089586a
TLSH
T1F3A002D502819705C440027493DD02D13725EA1917430B63929A94A9A9A61B6511165D
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 48cfe8b952257639872ad21c59380f759f5bffa1e89998c3560bcd42e7c15746
MD5 5fcd6122417c38e5d2db337b127fb62c
SHA1 086285fea2c1788bd68452e21211b7d5dffac257
SHA512 68e990371fe7727693204df900905381e2bef6bdf65d246e92afba94fe059ac78529eb36e564557a1da25551612189ab6b930b50896b2eaff2803f85a660203e
SSDEEP 1536:wIhHyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbG:jhJqfd7NtZL8cHQRZEQ6Sps9
TLSH
T1B4C30237EBC21E335DC2DB64BA130FD797F644A99034D301EA7D2BBB689345564828AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 471689b79dfb3fb209a1bc59bd95687ab4cd85218c3086b63dad03e682ff67cd
MD5 a17cf14b35afa43c6c4af563019369e9
SHA1 b94c0967043ba1d79798ce02c03a6944458f634d
SHA512 b6e277c95c9ed22b1458970a02d4b0bd8570a528d8ba3e19fc59539fa48b1957dcf763a61366f1ff60abe01908b55161e548b81268b7438ba0f57caa983c1312
SSDEEP 1536:wR/yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:aBqfd7NtZL8cHQRZEQ6Sps9
TLSH
T15CC30237EBC21E335DD2DB70B9130FD797B644A99034D3019ABD2BFB688345565828AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e522b5e0239b437e85303b09eafc81c6e594f8d02b43cab7c0f918ce2442fe9c
MD5 7d88c28c17ba4bf43e4a0411d06f8456
SHA1 a6ac21d98b54053ea8fb22778bd93fc8d019ed9b
SHA512 33d7e82123ff120fa9bb381adee84be6872e5fe03eb8c7a088465f783ac5a788ebdbfff68357ebf9b298c407446d98244abea5777ad8b3a24bfa33a7f6d56d55
SSDEEP 1536:6RyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:aqfd7NtZL8cHQRZEQ6Sps9
TLSH
T10AC30237EBC25F335D82CB64BA534FD697B644A99030D301AABD3BFB6C93451644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6ab4df07e76c6e6d53fe8cda83703ac1e20a2fadb01916d31608c4c0fef1c087
MD5 396231bbd3cbe5b431745e9c8669f514
SHA1 6a1224a4fb1b57941f271059f8232eda838a91f8
SHA512 661fcdd5cb77e26af5802a637bbdaed596dfdaf70f69cd2285272f4d1015c5af274e5240d479679696ecf634dbd26bd1b1a7b29582b1d6803c0d68339f7499e9
SSDEEP 1536:vW/yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:uBqfd7NtZL8cHQRZEQ6Sps9
TLSH
T127C30237EBC21E335D92CB74B9130FD797B644A99034D301ABBD2BBB688345565828AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download