e90f26489515f08cb2e018afb894849eff44dcb1eb32d6afcdd0b260ae509270

Analysis

user interaction
yes
max time kernel
8s
max time network
12s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
08/09/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
prankware.exe
Size 30KB
Sample260908-dch7racf72
SHA256 e90f26489515f08cb2e018afb894849eff44dcb1eb32d6afcdd0b260ae509270
MD5 62e3de48e180ad9c8b6b6a5b3a432efe
SHA1 7e316b0ae25b1165001565c45b1b8bbef6dd1e3b
SHA512 26b6f330fba1f8c3654b2c421e646593b80b6238204b74bd05b4dd15347978a7b5b98a4b5c68fdddce24ffc8443c0c24640c683e81fa689050743ee4ba2a3303
SSDEEP 384:AbxLeJajabzvEStUc0Gloz6vwhxjR4y3wuWW8IrN3D0qI5sPc0vY5LKI5pA:BXVY64rR4y3rWWTp3D0q3Pc0vY52I5
TLSH
T1BAE27C0BAB8B48FDD06BC17DCD725926E635B915634186DF23A2822A0F263E06D33643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	discord.com
49	discord.com
54	discord.com
65	discord.com
8	discord.com
9	discord.com
47	discord.com
48	discord.com
51	discord.com
52	discord.com
64	discord.com

Looks up external IP address via web service 1 TTPs 17 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
10	api.ipify.org
22	api.ipify.org
43	api.ipify.org
50	api.ipify.org
55	api.ipify.org
11	api.ipify.org
31	api.ipify.org
45	api.ipify.org
6	api.ipify.org
38	api.ipify.org
40	api.ipify.org
53	api.ipify.org
70	api.ipify.org
24	api.ipify.org
42	api.ipify.org
46	api.ipify.org
5	api.ipify.org

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7124	cmd.exe
7324	cmd.exe
7868	cmd.exe
8144	cmd.exe
7616	cmd.exe
7308	cmd.exe
3488	cmd.exe
5960	cmd.exe
5876	cmd.exe
6784	cmd.exe
7340	cmd.exe
7736	cmd.exe
7968	cmd.exe
4084	cmd.exe
4864	cmd.exe
1872	cmd.exe
1964	cmd.exe
3768	cmd.exe
6800	cmd.exe
4088	cmd.exe
7604	cmd.exe
7092	cmd.exe
4752	cmd.exe
4088	cmd.exe
2424	cmd.exe
8212	cmd.exe
6908	cmd.exe
7416	cmd.exe
7704	cmd.exe
8220	cmd.exe
6560	cmd.exe
7896	cmd.exe
8160	cmd.exe
5600	cmd.exe
2324	cmd.exe
6956	cmd.exe
7084	cmd.exe
7332	cmd.exe
7636	cmd.exe
7584	cmd.exe
7608	cmd.exe
7408	cmd.exe
7512	cmd.exe
5924	cmd.exe
2120	cmd.exe
6916	cmd.exe
7316	cmd.exe
7560	cmd.exe
2340	cmd.exe
7284	cmd.exe
8068	cmd.exe
8060	cmd.exe
8168	cmd.exe
7696	cmd.exe
2776	cmd.exe
1512	cmd.exe
2120	cmd.exe
5416	cmd.exe
6528	cmd.exe
8120	cmd.exe
5188	cmd.exe
8152	cmd.exe
5400	cmd.exe
6568	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4992	chrome.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4752	4044	prankware.exe	84
PID 4044 wrote to memory of 2488	4044	prankware.exe	88
PID 4044 wrote to memory of 5056	4044	prankware.exe	89
PID 5056 wrote to memory of 5924	5056	prankware.exe	90
PID 2488 wrote to memory of 3548	2488	chrome.exe	91
PID 4044 wrote to memory of 5916	4044	prankware.exe	92
PID 5916 wrote to memory of 4088	5916	prankware.exe	93

C:\Users\Admin\AppData\Local\Temp\prankware.exe
"C:\Users\Admin\AppData\Local\Temp\prankware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
    3⤵
    PID:3548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,8165902262156517421,12092525903232588699,524288 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,16551044326046645254,16808377092809745297,262144 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,2477202528087689595,6980039257461020615,524288 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:4108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,8548780029369818814,17336164148659062160,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:4544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,6932080586150501544,8330559723192754876,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4300,i,16147180120698377357,14792107084648847049,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:2
    3⤵
    PID:2732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4604,i,15801773401643328734,15203208111512820624,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:3344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4868,i,9135718846061267660,16581167120530717389,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5008,i,7358295136670506309,2207956685983537943,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:1028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3104,i,15944702314183324121,15666751421159427191,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5204,i,1213921245586007884,8261636510348263346,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:2448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4604,i,2237665970830388128,4934763649916289685,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5628,i,10631857421856325580,3143739763298465869,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5772,i,12587296769304696042,13189843764444636440,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
    3⤵
    PID:3260
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5944,i,5250440306044477123,7492806402591094218,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6088,i,4701873270604163103,16841955199547824965,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6224,i,16749901233453837364,7389773003285919018,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6252 /prefetch:1
    3⤵
    PID:4144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6392,i,14277069843238917822,12043320421510904268,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:1
    3⤵
    PID:6244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6528,i,3713970733065060976,8613284111926080707,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6544 /prefetch:1
    3⤵
    PID:6268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6688,i,10201509475633287636,3949931994938809221,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6700 /prefetch:1
    3⤵
    PID:6400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6824,i,14719700177661326596,9982901705738421443,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6836 /prefetch:1
    3⤵
    PID:6492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5480,i,16877069865565191174,3522055021348455718,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6988 /prefetch:1
    3⤵
    PID:6632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7116,i,13119475744134204528,14531202144560622887,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7124 /prefetch:1
    3⤵
    PID:6692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7292,i,7641195434103682152,12630107534775045165,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7280 /prefetch:1
    3⤵
    PID:6808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7432,i,6605652218466548802,2839932493072543659,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:1
    3⤵
    PID:4448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6240,i,17029711848441191589,18108364078978116197,2097152 --field-trial-handle=1616,i,10245191656567773721,6116071873326353952,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7556 /prefetch:1
    3⤵
    PID:8408
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:5924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
    3⤵
    PID:2484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
      4⤵
      PID:5968
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:3172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:4084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
      4⤵
      PID:5496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x224,0x228,0x22c,0x1fc,0x230,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
        5⤵
        
        PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:4624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:5060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:6276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:6704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c dir /s
      4⤵
      Executes a command shell one-liner
      PID:6784
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:6932
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7500
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7820
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7376
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:3824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:2424
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:5352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:1872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
      4⤵
      PID:1228
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
        5⤵
        
        PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:5956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:1292
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:6472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:6768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:8088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c dir /s
      4⤵
      Executes a command shell one-liner
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:8196
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
      4⤵
      PID:6168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x218,0x228,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
        5⤵
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:6508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:6836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7208
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        Executes a command shell one-liner
        
        PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\prankware.exe
      spawned
      4⤵
      PID:7400
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:3016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /s
    3⤵
    - Executes a command shell one-liner
    PID:2324
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:3008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:3588
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:5012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:1964
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:4616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:6124
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:5140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:2340
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4088
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2168
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2776
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /s
  2⤵
  - Executes a command shell one-liner
  PID:5960
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
    3⤵
    PID:5020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1c0,0x228,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
      4⤵
      PID:2128
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:4972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:4396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:5416
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:3648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:2120
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:3480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7408
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7560
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:6916
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7384
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7240
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7332
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /s
    3⤵
    PID:8176
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:1512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
    3⤵
    PID:6036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
      4⤵
      PID:4264
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:4820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:844
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:6956
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7512
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6656
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7736
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:8052
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7604
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7468
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7784
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:5600
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:8032
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:8276
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
    3⤵
    PID:4444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
      4⤵
      PID:2760
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:5480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:6800
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:5368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:6568
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /s
    3⤵
    - Executes a command shell one-liner
    PID:6528
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7744
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7968
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:8152
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:8220
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7584
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:8024
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:8204
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
    3⤵
    PID:548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
      4⤵
      PID:5116
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:3768
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:6584
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:7752
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:8060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /s
    3⤵
    - Executes a command shell one-liner
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:8160
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:8076
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7836
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7696
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:8188
- C:\Users\Admin\AppData\Local\Temp\prankware.exe
  spawned
  2⤵
  PID:2328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/watch?v=85SJ2Oj1RWE&list=RDzDjEw_VULDM&index=9"
    3⤵
    PID:6184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffff864c728,0x7ffff864c734,0x7ffff864c740
      4⤵
      PID:6312
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7124
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:6824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7308
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:1964
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:7704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /s
    3⤵
    - Executes a command shell one-liner
    PID:7284
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:8212
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:7760
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:8040
- - C:\Users\Admin\AppData\Local\Temp\prankware.exe
    spawned
    3⤵
    PID:8268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 cad5c39cf6c698c1c5530a498696618065754e911ee9850dc96f4b45860e1040
MD5 54977efe7d95bd4ef17c51938c964ae5
SHA1 4aa263b719dd10d87d4cf6871d0c7b07160dd604
SHA512 9c7630542c6709cf1f9dc2d3e1738deb4c703a750f9e2c10d89c02d00d6b639a02d2e22f44a68979cd994984ea74ddf81a366de2835abbfd7c0798716ffc9a86
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 37KB
SHA256 4cbadc5023dcbb28829dd9871a917e3360eccfa90cbfdc641d11e8118c758b43
MD5 9b7c9652fa8664b72a5266b1ce955aa5
SHA1 96106fe7cbfec0735d47fd050e06ae991b92a895
SHA512 409e036676dc76a4a9cbec530a97154beb106ef3f5b89f675718cf25f9ace6070eec7f6ad4fe030be92ebdd6ef2c2e615aeb7d625fe99ca341bc5c63bbe2ab8c
SSDEEP 768:TvjIPwunrteOy3OuQhMzdY+Ckq753/D5G1coxuwrXHGs1YD:zcwqR2mfUu53/1G1AGGR
TLSH
T16003F191348ACB6B73908C78C9584D2A4E929902EDBDFD64281C7C5726DAB7D3CC7117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Size 56KB
SHA256 d1490249059b9cb0d8f6677be2c90f7dcfbbe75e48c309d5eeee2c5c06a3307b
MD5 7b5133418554f13b499f44460a6ba45f
SHA1 de62f6c38f6f045ee015c32a0d45a21f7c825b07
SHA512 9a590c9e0c3d00c1be1f3143be7700e83f3b8e68a4128039bb57129c9fa024ac8c1a9d536fc1b913815ab33f6eabaf178991e7ce713080e0b732b7612c0c564b
SSDEEP 768:wIY+qNHuE3Mak99vcMT3Bhl9rUEmeVFRuETkbbJVd92RyJdnu2dZnOYey+h:Q+sH73aDlhTWeZq92oLOlnh
TLSH
T1A44302284CD2A183DF738BA7F0E7BA4E95A0612C2F91CDB01ED5411A3D954293F68B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 20KB
SHA256 4c1195176cbfa92074e27fb66b225cfaee22d5e9a807d826aa7ea00c6a31fe87
MD5 84dd16f09f8e6958f960e0cd6f68ba43
SHA1 501264b81d12b45470b73aef7ea184f247b27e21
SHA512 f5a06a0e0af5176c99fd6e2c9ed0aaec812cca7b4aacc8aebf997c4c97df24635c4467e133064f21cd44818bf50e2870a6dd8b4712229dfb4607ebef9845317e
SSDEEP 384:NpphKFHkORBPtgcjPr69BcmQ5ucNlg+Zg8scyoTXcJ/YMJlBa0/k:N3hKFzPtgcjebcmQ5u6ZgvcbW/9BF/k
TLSH
T169A2E1F2BBD7C2189F4C3B42259ABC1DF3823AA82283D5F2594341E9977F7B13290558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 094a18bca23ad0504055f4d3893885c6b45080acf6c1dcfa9d81bd3320df7625
MD5 bf3b655460c70090e1ce9cf57112ee2c
SHA1 0489dbd55fe4c01e33038539e042c57e7d6282d3
SHA512 e7529221eeb3f737188c50e87376fac62415ff193b376d83416f15c8c1c1df697ab44103050f1f159cc2ad67f45cb118ac84675c3ec36f40a0692f9ddbf3b77e
SSDEEP 3072:TsGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:Dm7Rkm1tYpBeh2BAon
TLSH
T148C312275D71A97B59B9BB4EB08E0B1F1EF149A2C930DE92C8D85B0437F97C81A48D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads