785489dfa2c67bba1eb28df800e6f102214c224bf7d55a0acb885699a5280597

Analysis

user interaction
yes
max time kernel
300s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hydrogen.peaceful.exe
Size 94KB
Sample260910-1xt63shl7t
SHA256 785489dfa2c67bba1eb28df800e6f102214c224bf7d55a0acb885699a5280597
MD5 0771772e2401bc2d16f58f09f8f00036
SHA1 2832a2b85681550ecb712483526c91bc9e5c122b
SHA512 6f045a276092871d1cfe3c76a187f4e3bad4067c2cbc01429141a8b1b91d698a433734a2e9328304bc640ed7dc0bd6b4099301d0998e963d69a1a6bf8f74e057
SSDEEP 1536:TWov8zFELmmScoEZexf16URRpG+MKJPRBVaAjQOWqJZF766VVcDcUaQJhhsWCxtf:T3QzjRLG+1pTVaAjQOWqHFdVJwhWx8YW
TLSH
T126935B01F5D1A4B1E4B3583219B1EAA48A3DF9B51F258FFB2794022A0E740D09D37EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hydrogen.peaceful.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335513454320779"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3116	5016	chrome.exe	87
PID 5016 wrote to memory of 4528	5016	chrome.exe	88
PID 5016 wrote to memory of 4528	5016	chrome.exe	88
PID 5016 wrote to memory of 4284	5016	chrome.exe	89
PID 5016 wrote to memory of 2364	5016	chrome.exe	90
PID 5016 wrote to memory of 2364	5016	chrome.exe	90
PID 5016 wrote to memory of 4716	5016	chrome.exe	92
PID 5016 wrote to memory of 4716	5016	chrome.exe	92
PID 5016 wrote to memory of 1244	5016	chrome.exe	93
PID 5016 wrote to memory of 1244	5016	chrome.exe	93
PID 5016 wrote to memory of 2376	5016	chrome.exe	94
PID 5016 wrote to memory of 2376	5016	chrome.exe	94
PID 5016 wrote to memory of 1884	5016	chrome.exe	95
PID 5016 wrote to memory of 1884	5016	chrome.exe	95
PID 5016 wrote to memory of 2016	5016	chrome.exe	99
PID 5016 wrote to memory of 1092	5016	chrome.exe	114
PID 5016 wrote to memory of 1580	5016	chrome.exe	115
PID 5016 wrote to memory of 2448	5016	chrome.exe	116
PID 5016 wrote to memory of 3840	5016	chrome.exe	118
PID 5016 wrote to memory of 3840	5016	chrome.exe	118
PID 5016 wrote to memory of 4852	5016	chrome.exe	121
PID 5016 wrote to memory of 4852	5016	chrome.exe	121
PID 5016 wrote to memory of 1236	5016	chrome.exe	122
PID 5016 wrote to memory of 1236	5016	chrome.exe	122
PID 5016 wrote to memory of 4588	5016	chrome.exe	124
PID 5016 wrote to memory of 4588	5016	chrome.exe	124

C:\Users\Admin\AppData\Local\Temp\hydrogen.peaceful.exe
"C:\Users\Admin\AppData\Local\Temp\hydrogen.peaceful.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffb5cafc728,0x7ffb5cafc734,0x7ffb5cafc740
  2⤵
  PID:3116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,4687505018521630600,1716321014695178128,262144 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,1220146318771678733,17179840968285731159,524288 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,9664980234114441285,7271770330862469169,524288 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,10701758760202332154,2949905927995604595,2097152 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3452,i,4082024070675161237,17646311795126745459,2097152 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,8204609716583274503,15877707841372843139,2097152 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4496 /prefetch:2
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,11285384051927622522,10832034346017043828,2097152 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,950514694546958037,17976557836994576762,524288 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,4810579325108245163,1296290469595677189,524288 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,8887153644772759553,7953842197492291221,524288 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,14044780053471242168,12396178630372938411,524288 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5852,i,13331503390043404212,7717363245027525029,2097152 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5980,i,10430815538810572098,12370018453393052475,2097152 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5992,i,14114080989278144786,5765097759102688257,2097152 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3564,i,12892239348658701160,9461384354721292574,2097152 --field-trial-handle=1996,i,856529891752713107,6251704359139267093,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:4588

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3440

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "628" "2340" "2300" "2344" "0" "0" "0" "0" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 55927474a01d40c0db98c8f8c315ef63ef82d7ddb868d3753eb7b62fa0a22a97
MD5 355d56915cd897d8bae220d6917d4eef
SHA1 cbbfd8728d15e2defc752a7768cb099c85ebbd72
SHA512 86a73a6525ca2f14c763dd3e2efd41672ea8b24f2a1ac6e162b8d5f30ab40bc8aa89fdabb08e4b07bf25f8a69373222461418b3d81db129c96aef79e49db05c8
TLSH
T198E02B69C861EC271CFA0719A0541782DB54235B2A40D94F7E3DC11D8FF1E374595D6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 5cc6f4609d5cea76f8f6aa38eaed2ebaf71e4c7ced34ab37cd976830e9a074ee
MD5 2ef69d6f715584f7d48f19198c64e6a3
SHA1 9dfce207fb08ebc260e2ee2f93e75017243a1f33
SHA512 76de3493e204ae1d3dad9c3abde9e6dc355fc9e5fa329b50937b4d09cde1158ee0a93ef0a4fe087ad05ac31370e068b6a5011e818398e4f2e41a762b056816c2
TLSH
T1DDC09204906150A6E3AA8374B1FE94C4346D193A01A2056558E1E28478666AAD191741
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 0d31a473108f681e8595ad5032edea40a26725a50c9eaedade49b13e5dd0546f
MD5 cb992cda759a44764b821108f8d6476a
SHA1 75f5a9c14d89e86a4e32ccb2a1ad0c48805e2cfe
SHA512 ab60ee3ac74a09e290db63a49cbc9147470880bcf8ecace7d5fde76ad68e577f65cc9c1b4f3e9803cfdb3cb3b56f982d5d38c8d9c4109c3945405b71089216f0
TLSH
T16BC02B4084404049C3F9C331F1B148C001283E6A0412A11108E3F1C03433458C082708
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f7afa9f7bf3501955cfb945fc2ac2b0a973fa167ba4b119231bd027e569408aa
MD5 5aae76c838786b77bc7fbc9b988303d2
SHA1 b281b3abac2472271cfa2ab9513dae2ba66b06b6
SHA512 df9df0804b7794348839659591c5dc961145a2db4b8469901efd023a6f416b894fe10626adbcf828bcedadda796ae6ecc30fecb444da00a5be8d609ee912a89a
SSDEEP 3:MsEllllkEthXllkl2zETHll:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a655cd58dd15d6c41d96b4f85803255ea3c365324fefb5315de6eff933f3293a
MD5 81f0925cb88109a1583301f6f74444e4
SHA1 3d227cebe0aff6071b1e85d1e4f4d86bbfea0e88
SHA512 23e7d5063040ff8ef08aed43d933146c6efaad65d389e21904a46d73b3c7f012a07914877f5a87535885e60d469d9c6d841e0bbcba5efdd98d52cc66827f74ff
TLSH
T175716BF7C3D8862D890196F49B156E2FCE2D0A24531D3C6688D8AE6B53E2972D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7e4e741796aedf9f0248a46313c20f2213178dcb0b8d89e31bd144d7676f2e99
MD5 f2106d59afabd3748e52f0ededf3d545
SHA1 de4bc7d9e1e657aceee2cb7b281641c2949765ed
SHA512 fa0edc4e7ecb533b2aca23ade10eea3898d582ca479c745c4bf92e2b645cad8879bbc43687f1d39b81bbc78112702b596301ed6a8314e9095ca7c9be7d6194ae
TLSH
T119718DF7C3D8C62D891196F49B156F1FCE2D0A24531D3C66C8D8AE6B53E2872D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 ad2fd7abf8c3d8f5fba3a0e2956b518040c3cf034ca912274e2c3c9337117a31
MD5 586fc5dc0ee0e4391c938ba0d0de83dc
SHA1 0642f1b4559be5ddef20a5499c223acf50865c41
SHA512 bf4db3773eae8c1cfb9e15ae88f5639b686d1fc1bd02e3447b7920cf78ed1223b4d486c3a649d050d751e0de6759cd098f285f0663ba2bd11ab37f8897d31bc1
TLSH
T165F05977A77E787B50BA45BF5E00BC497976AC3402815CE4CF9A812D90885A70B13493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 482de3a9168352fb0b74b6d12829b87a17b96e7c088994d336ce504047b4ec52
MD5 77a4a161744e077f53ec10044bbbe4f5
SHA1 3a5eb540dd021cef69b18854626fd2cbd59fb79f
SHA512 f181445aaf93c8eb310a959b8c28901bacdcde292c558a7a5b6cc04e2aca68bc6dfcfa83a450f2b2d721f698efa0db023674ec44f4e5713f3740ca1f4e313dbf
SSDEEP 192:1RoLIklCa2v3v70hAPRp2dAJT9+Hsb+WNnst4zn829lra5OFcVyIsnAUgraJ:1RoLpUfg8XB8wQc82Hare
TLSH
T18452D72AAA102D3BACDBD319F922B753D7F6212121942E84E7FC8A1C05E75CD3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0e07e7063f7893bda3e3d9018891e346326a2e65f6d932ca712c657e624a2676
MD5 8c1718ad8dd2f855033a937a752af73e
SHA1 67ec6f4f65ce40de3299edadccdc1fed98c7537f
SHA512 51b3281543224f60b3bb9c0531bbd7a8852db47a0ea4da65ae48c93925c25c83c4ddfaade77c730cfb71464268fba9fc15bdb0b35446decd969d747a33a01c5a
SSDEEP 192:aRoLIklCa2g3v70I4PRp2dArv9+Hsb+WNE/bAThB6IIr0lra5OFYVyIsnAUgraJ:aRoLpbfg5Xv8wffIruate
TLSH
T12F52D82AAA10297BACDBD219F951B767D7F6202125D02E84E7FCCA2C05E76CD3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5cd618f6d668b4e3963e8b1d5f73ce42241a223861b6746b9479d8e73d35511f
MD5 275f8737bee77a95b1cf63917779a34a
SHA1 4bc8efa14a310d9733fe8cec89270149d6a693ee
SHA512 46938b0a7c3df3d6f74cdbeef30bd409fa86d39ec92c512e09115c5928cd849443c68438383fbeb876e42291c7fca95ef92addac09e62b0ea744f45983b549c2
SSDEEP 192:1RoLIklCa2U7v70pAPRp2dj9+Hsb+WNnst0Ilra5OFQVyIsnAUgtaJ:1RoLpJDgUX68wQ0SaP8
TLSH
T17942C62EAA14693BACDFC21AFD627753D7F6102121942E84E7FC8A1C09D76CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 baf5711d576f9b820125b447ec05fe00ba10fd0118c9af5bc8d04057dfa3bc0f
MD5 c3f6656011d7749468cc5bd1506dea87
SHA1 d96cdf556c54c9563e33d675cfbded3cd86a594c
SHA512 1fc5e57a0b2014fe272082504da08737871622a0fa794a5e44ae0897e9ff8daa32e1bafc9ff676e0c6e00f5641d1e1805f211613751433f6bb2ee1ce4b57dd94
SSDEEP 192:1RoLIklCa2y3v70hAPRp2dj9+Hsb+WNnst0wlra5OFcVyIsnAUgraJ:1RoLpRfg8X68wQ0qare
TLSH
T19142C62EAA10293BACDFD319F9627753D7F6212121942E84E7FC8A1C05E76CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b21836631e53443a53b46d45137e2fce005ab4bce4a3385c00b0b3659b499b15
MD5 8f81e1c1c36317dbe25d44938ffaa4db
SHA1 290834a703da659f7b33425314daba4d9bcec760
SHA512 3ecbea8648cca49e7a6e8652b7995aa1b6cb81fa82b63ce7e797152f5a758e83fa23c27b184ebd4b22b1dc46901e659a01bc238d3f13c0a0f08642348d263a18
TLSH
T18EB0124080029911C08302B896821488F1189F14960A670143E0B922C8251618118050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5909da.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5909da.TMP
Size 96B
SHA256 d5761bf8bb0af6e5b1fbea736020b831b83f377d8bcb36383b82c08d1b756dc5
MD5 503d19f4293106c900ad1958c757bfaa
SHA1 6261191f9f55c7f02628e78253db29fce4f60473
SHA512 6b1d6f1de6a9b3425420e95711e011d382b1aeb81784d4ef19ddd5bb47bfe913a437a4db70259ea4625f7ec3b3ee709c7578c876c4079d585ed689e641e0208e
TLSH
T1E0B002E9C9026312C04307B065A9D6D87171DF2ACB07221293F46A67DC666F1453D160
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 5752d9546a91e83f6a4c8de222f446ffbb6adbb0b2a2609623762e2e3be99bd4
MD5 60ada08db906108690a3b4f78a18b876
SHA1 478fe1020a02c53cac3a5318d77d65a1996026b8
SHA512 b3865c347a4c71ab75d6c9fb5e57bcafd4586e55e929c0245b979910e4798379b28b56923e811cb76f517c8327e017b50e65f8491cf299c28b9afe687ca14e8c
SSDEEP 3072:M6kna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPSqfd7NtZL8cHQRZEQ6Spss:M6elC949PSmzO3XvANUPSqZ/ZLW3Exs
TLSH
T163341272DBD22E3679B1CF88A4C38F865FF440D9C520C2C966EDF6AB6482D126C16C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 aa2009c53b4ee6d99b51cddbeda80907bdd5db842e838cf54a46ad1b11ad14a9
MD5 aa3a664073ec7f23364449a6613c4fff
SHA1 72a14b2537489c83acdd06d0177df342d88a86e8
SHA512 d18372bade457178fcee3257dadd326f6e43f46789e70dc1daedf6bdb733a327664aad006b06d99457828b6de7f6c88c6b04922cd575d5c6cccd317476b3b73e
SSDEEP 3072:dBna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPSqfd7NtZL8cHQRZEQ6Spss:LlC949PSmzO3XvANUPSqZ/ZLW3Exs
TLSH
T182341372DBD62E36ADB1CB5CA4D38F865BB440D48020C2C666EDF6EBA083D566C16C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 a788369528a096fd2e5e94518d7e6450710e21353a47d3833bdbb3f865f5d51d
MD5 74a9c9e805e96ac0e57cff56ac1e49f4
SHA1 b9d1d51f01d38b785fb7d80ab259158b4d79904d
SHA512 394e9e862940fe3626c067db3de2145b8ffc2c77670adab54f0ebc9ff1d8ba3b3f59e65dc7d027739b8a3e9cab4842b9498da1a53ab4f06cbe46c16d7c819c5e
SSDEEP 3072:yHna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPSqfd7NtZL8cHQRZEQ6Spss:yHlC949PSmzO3XvANUPSqZ/ZLW3Exs
TLSH
T166341272DBD22E3669B1CF88A4C38F865FB440D9C520C2C966EDF7AB6482D126C16C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c8fe5c43d784d9d016191d1652bdb9c6e7001bba9c99d4d8337479b95acc644b
MD5 a30ee9cd24f307441d2f42a499e4a6f3
SHA1 57e835f1b0ec8231229efbee73cda792448913fe
SHA512 b4a24254b93481ab57779575a2e2d1d990ed2fdc75a3bb6f7088da95fc58e77cbc9b3b5a7d8ef4188a51556a7aab4565ae5d84922497a424ef9fdb08439af53d
SSDEEP 1536:b/LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Bqfd7NtZL8cHQRZEQ6Sps3
TLSH
T19DC30237ABC21F339D93CF64B9130FDAA7B644A99030D301AAAD37EB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 242KB
SHA256 e1d0c95e07b6f5cfe33983114389b124d50f2327e6e8b1d434a35a03944e812a
MD5 1f540229d276b363b68f8ec9e656dead
SHA1 0e29fe900d8976f6c86dc62ef51b667a7651c36d
SHA512 49a03776a047ce84b40da2dcee124eca9c1c877a91343d29fbbb0080e41cb3c133c42296ef8cc2c3fa23acf485779481a89c595f9a7b0f641024e60c50494f29
SSDEEP 3072:gBna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPSqfd7NtZL8cHQRZEQ6Spss:ilC949PSmzO3XvANUPSqZ/ZLW3Exs
TLSH
T1F6341372DBD52E36ADB1CB5CA4D38F865BB440D48020C2CA66EDF6FBA083D566C16C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 243KB
SHA256 c38cff6e128c6a5c8eeb8deeb2a4a6ca1bb61b68436d52ba2125b8f781b9bfa9
MD5 3d07a97d756e9e90451f86720e750cd2
SHA1 b56acef3e936d4ad0c4c3b30fbcae577568bcc3f
SHA512 a252b0cf335d925579ff28f53e0c921d4f100bd590f61a9e14174cb77267fbe5f56905e3be77de228449bac6df8e33d269ae1ad7056f73af822e5377691bdc2e
SSDEEP 3072:Y6kna7BqTu94Rbet8CWTSmnJMjmYN35xvAyV4LgPSqfd7NtZL8cHQRZEQ6Spss:Y6elC949PSmzO3XvANUPSqZ/ZLW3Exs
TLSH
T191341272DBD22E3669B1CF88A4C38F865FF440D9C520C2C966EDF6AB6482D126C16C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download