16fd4d6d813f72438c09c06c5f026f08993d2f551997d9dd4b86187a24b6f56c

Analysis

user interaction
yes
max time kernel
59s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
surya-launcher.exe
Size 17.1MB
Sample260925-vb6ebssx5j
SHA256 16fd4d6d813f72438c09c06c5f026f08993d2f551997d9dd4b86187a24b6f56c
MD5 dc34bbdcf05cefb7d76600ba839a9050
SHA1 24fd5f1b2fc1d650f5bcc9a02a3f6b7e1933996b
SHA512 ed2d05d460c3e80272d4c931399ffdbf1258cfbde75e07e3db12164a3218f17934c94c84b601cb6b0e90806d433f703c800f6e622ae7881805a73b06a7013475
SSDEEP 98304:hoCrIQAKqFNxKhZjcJiLmj+FsyiyL/KXD1uDChQ6xc8zlSUaTKdmKNb+YmMJjzzu:3eYhZx9+1OCm6xtzl5db+YmMJj/G
TLSH
T16D076C12B7DB94ECD85AC470C34B5B672E11748A0B267DEB46C8D6393F79BE01E28718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5180	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3728	chrome.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3492	WINWORD.EXE
3492	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5180	powershell.exe
5180	powershell.exe
5440	chrome.exe
5440	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeIncreaseQuotaPrivilege	5180	powershell.exe
Token: SeSecurityPrivilege	5180	powershell.exe
Token: SeTakeOwnershipPrivilege	5180	powershell.exe
Token: SeLoadDriverPrivilege	5180	powershell.exe
Token: SeSystemProfilePrivilege	5180	powershell.exe
Token: SeSystemtimePrivilege	5180	powershell.exe
Token: SeProfSingleProcessPrivilege	5180	powershell.exe
Token: SeIncBasePriorityPrivilege	5180	powershell.exe
Token: SeCreatePagefilePrivilege	5180	powershell.exe
Token: SeBackupPrivilege	5180	powershell.exe
Token: SeRestorePrivilege	5180	powershell.exe
Token: SeShutdownPrivilege	5180	powershell.exe
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeSystemEnvironmentPrivilege	5180	powershell.exe
Token: SeRemoteShutdownPrivilege	5180	powershell.exe
Token: SeUndockPrivilege	5180	powershell.exe
Token: SeManageVolumePrivilege	5180	powershell.exe
Token: 33	5180	powershell.exe
Token: 34	5180	powershell.exe
Token: 35	5180	powershell.exe
Token: 36	5180	powershell.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe
Token: SeShutdownPrivilege	5440	chrome.exe
Token: SeCreatePagefilePrivilege	5440	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
872	surya-launcher.exe
872	surya-launcher.exe
872	surya-launcher.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
872	surya-launcher.exe
872	surya-launcher.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe
5440	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE
3492	WINWORD.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 5180	872	surya-launcher.exe	87
PID 5440 wrote to memory of 1840	5440	chrome.exe	108
PID 5440 wrote to memory of 3728	5440	chrome.exe	109
PID 5440 wrote to memory of 2812	5440	chrome.exe	110
PID 5440 wrote to memory of 2812	5440	chrome.exe	110
PID 5440 wrote to memory of 2268	5440	chrome.exe	111
PID 5440 wrote to memory of 2268	5440	chrome.exe	111
PID 5440 wrote to memory of 5712	5440	chrome.exe	112
PID 5440 wrote to memory of 364	5440	chrome.exe	113
PID 5440 wrote to memory of 5712	5440	chrome.exe	112
PID 5440 wrote to memory of 364	5440	chrome.exe	113
PID 5440 wrote to memory of 4220	5440	chrome.exe	115
PID 5440 wrote to memory of 4220	5440	chrome.exe	115
PID 5440 wrote to memory of 4756	5440	chrome.exe	117
PID 5440 wrote to memory of 4756	5440	chrome.exe	117
PID 5440 wrote to memory of 4396	5440	chrome.exe	120
PID 5440 wrote to memory of 4396	5440	chrome.exe	120
PID 5440 wrote to memory of 2864	5440	chrome.exe	123
PID 5440 wrote to memory of 2692	5440	chrome.exe	131
PID 5440 wrote to memory of 2692	5440	chrome.exe	131
PID 5440 wrote to memory of 2676	5440	chrome.exe	132
PID 5440 wrote to memory of 2676	5440	chrome.exe	132
PID 5440 wrote to memory of 4556	5440	chrome.exe	133
PID 5440 wrote to memory of 4556	5440	chrome.exe	133
PID 5440 wrote to memory of 4960	5440	chrome.exe	135
PID 5440 wrote to memory of 2844	5440	chrome.exe	136
PID 5440 wrote to memory of 4684	5440	chrome.exe	137

C:\Users\Admin\AppData\Local\Temp\surya-launcher.exe
"C:\Users\Admin\AppData\Local\Temp\surya-launcher.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process -Filter \"Name='surya-launcher.exe'\" | ForEach-Object { '{0}|{1}' -f $_.ProcessId, $_.ExecutablePath }"
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5180

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\DismountLimit.rtf" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ffcf594c728,0x7ffcf594c734,0x7ffcf594c740
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2044,i,11533146146100913454,3254907835306049515,524288 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,8306825112846805657,3183258343354470972,262144 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,16978138232144435696,4101508288620380052,524288 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,12826780458661563350,12128739218080217686,2097152 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,7610414258351387939,15709096139528732561,2097152 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,12505650440795068910,3199725947326210341,2097152 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4812,i,12061254786324701503,18005836282293671981,2097152 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5016,i,6505184405131502176,10732444791549182844,2097152 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,13931301175393949133,8465902395495107166,524288 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5844,i,8275358217640694009,17211670821633011428,2097152 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3008,i,7566012632700706949,16068835233451735433,2097152 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,9186440871131646616,7991252232755515137,524288 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,6098292226029912802,12821062743176195381,524288 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,17882226174978595737,11700160294875435072,524288 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=244 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,4100116072974948995,5003792741250017094,524288 --field-trial-handle=2104,i,17890586994059670976,1550241342393117601,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ca19d5df25f3cf0cc7bfe6a89e403bbf3d3f42221a758ebee9774aed775ca2c2
MD5 5d30a57576fd95552c7bda309395766e
SHA1 a3ea0f9165542240d23b092d28f75fc919fdc044
SHA512 8ed50dc4ff38c7382600717df4d142567d3fd36aea76f5d6134137b620bbed6e81f1a3fbc8b29af523223009b400537de0bd05ff1f5d550dbd76e35d4a015951
TLSH
T1ADF02DB5C821AC3759FE071920A58A46EB50232B2B40889B3A3C811C8FB063B8A9995C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 348KB
SHA256 f8a1b823a87944a3c4f17d3af703dc750d386a94ca4a6c6a5f8ba1b59791417e
MD5 e15a9442a6ee1704db873e81143552a6
SHA1 4e8cc552eb02f71fb3bf652376da6b2380898ccf
SHA512 e7e1ed61d90c6e32ce05a06b83a6d3175c178232a99fa7d297e17a67952c9f9b8d4d483ca4026d43ee0ce0662ab3bf5f662e0b905601e9a7c3b2bdf57ca176d2
SSDEEP 6144:jgxSiMzLJ2EDV18L01IvoqGiG4mCvRB3h9JUrwxWD2O9aGaclP:Y02EvY01x7cmCvRBR78Rn9X
TLSH
T1557423084B6DC4874E04C9AD07ABA1EC760335C60ED2DBAD406FB5ACF17266DA4635F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0aa08ffd34b3d4dacf5da42a84368a226d352c53f80c42e1b21e646333860c19
MD5 57e919e3c7e3f55acf176c06909d2d54
SHA1 4d1e013c087449dea25b24101a5cbccdaac20bba
SHA512 4f32a41ce5b508ecdf4ee0f0d273f73ed1e493418a741170d963661d9a5a587e2cb402d3c8888fd949da03da2f6532cf3e165f347650cb3fbece7c41d39a3c0c
TLSH
T1991166189C4E6501DF8EF832A4C9CD643339D55C6B464F2A1D4E84FD278BEF40C51922
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 70a2a8e974b26c45b0c74c928d404b27ade32ce298356054653d59ecdca0179f
MD5 ae62e632097a6b19dc533ffa57680d76
SHA1 07c3ffcfbe1ddf365d76569fa95142fdb6451ec4
SHA512 8b95c01172a933d461ac157c116a5ba877c62886558b1338ef6beaa6b64db93b44bc40c754277e42d4a5bbe656d7d3e2558bc1d7ccebe0e30b3c4b98e7bafda6
SSDEEP 192:DyMt8OetxMJ5ZcKqlNWZ1N6KBLmh4UNPkaPivhfPiZIlFae/1:DyMt8OetxMJ5ZcKqlNWZ1N6KBLUHNMaG
TLSH
T12A02A0B7C3D8862DC81156F49B257E1FCE2E0A18432C3C66C8E9EF5BA3E1572D25124E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 735c7b1f0e6f55f051e6b5419648255e905400ac990f815d51c7cec4f53d23e6
MD5 ff228e92b1ada307a6a41d1cb1c9c9cd
SHA1 50f7c6f6fb9f078ba3fd52611b595aef0d4f59c2
SHA512 dffb3aa576f33e9d62d2af4651e62d09a7d6c4e4d5f6ab754407a3dfc1870377da04a590b9f33d695576d01cc1c4d7ceeef8c444d1a16a43bae88ecee6a737bd
TLSH
T1912199A7D3BE786B103A48A70E50B8076BBAB431514160F4DF6B81BDB0C19F76B12413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 348e63f1246020d8962f66f423b45897518521f1abf56ba619140b15bfaf5f57
MD5 f3a6b14441c32d3f172d2b24032bc000
SHA1 02faf98211972afe50698752fb64b2935975762f
SHA512 c3135e4f13a075dbe48b64736a1ef1548cc32d2799985e75a22bfe77d33ca96dc074a8be15de660ad29f79ef15bad99dcb08f695d036f05c7ed4a6244310a8f4
SSDEEP 192:hRCPMzKmHf/pv78pAPRp2YLM9THsb+WNnHU4xe2eeUxjHkwoVyIsnAUge:hRCPuK2p4UXuJw072eHjse
TLSH
T12B42952EED14757B4CDBC21AF966BB57D7F6102160942EC4E6F88A3C24E76CC6217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8170ffd2875930751aff32d5265827537a6e30641462460fbf99553b15a098cb
MD5 d927ae8c04baee4adc66ed335feae2c2
SHA1 80a486617f4c9d0fa78e112cf23dc389a2d4b7b0
SHA512 c6042c3c3d5bd33a155146998d7732c4aef32dd6df3b9ad61097d31f97eaf00737f548346606b7e96199a962e99adb93eae2eb1bf5ea54c90f5fe05ef9c01a93
SSDEEP 192:hRScBzPMzKmHf/pv78pAPRp2Yh/B9THsb+WNEBHU4xe2eeUxjHkwoVyIsnAUgtaJ:hRSmzPuK2p4UXpJwj72eHjs8
TLSH
T1E352942EED50757B4CDBC22AF965BB57D7F5102160942EC4EAF88A3C14E76CC6217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2e4e7386a2feb4c7417f329562c17f478671bf2629b0773b435b1f0d583d14b7
MD5 2ece36cd65f35bd0fff3ea0d44f17653
SHA1 80e97900b4c432a8205fa4b051e0696f281d4464
SHA512 bef264142d7410f759a40df07d4ea455136846c55e5474131c1024baae306d72ab24fa099d3e391f50ef32b9a0d9e5cfd2806bc2d41dc0a322fbb668e0db4baf
SSDEEP 192:hRScBzPMzKmHf/hv78pAPRp2Yh/i9THsb+WNEgcHU4xe2e+UxjHkw1rPyIsnAUge:hRSmzPuK2x4UX6Jwx72enjVfe
TLSH
T15852842EAC50757B5CDBC22AF925BB57D7F9102260D42EC4EAF88A3D11E76CC6217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
MD5 c8926c13ed1e541a9ebca052800d518d
SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
TLSH
T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4d0e42c96aaf873644f8fed144eaef85a91b6faa3d05f0ac066f19a8af8ed09d
MD5 a0f541ac78fb55a52469b03901a53e73
SHA1 4f74df86fa3bf1b9f3fd6c3df2f25bbc0215e035
SHA512 8c805b42ff99531551e840e49481878b7b63692e6093a8efeff7810f1729237bff5101bf7ce68ce87a9eafeb03418a0a716ac89d73a7f1834941d7ea5b2b2504
TLSH
T1E6B0124990C12311C00103B11550E45873608F38D21213C651E00D018C321716097208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5962e6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5962e6.TMP
Size 96B
SHA256 aa7092d5e75028ab84058708687bf3b193e839959392660ac9ee83942d78a71d
MD5 4aae8dc807b2a085ba207f9b69598ed0
SHA1 d8b2b4884c82bba2a3b32c784aedcb470226ac66
SHA512 0ba043147a9ed1425bf059fe7d845325bb02bcb556666ef3c4b4b049f2132d6a708ca29f519bd1c6e3ade308f5a69cfb39102bc79b054303456c8237cb021ff0
TLSH
T1E7B02200C0033202C80203B0288C80CCB020CF38C303032383E00EA2CC2323300A0020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 0152d3b83e8675749e73f47e2f500d96d4c0fb47bb617d1c9b7797613b20b840
MD5 aa1a01ed7bff23cbc20de6094cdace2c
SHA1 755f3d71c5448a44e049e94cc678fecc86448e6c
SHA512 72a90200bd51cf553bc50ad2b6f3a4b54d9d70c3dd541f42d7db58e9a5e94454d680d795d1d29533880c4a0c75bcbe9967f62ec9eb3528731dd72ca362771085
TLSH
T153A002B849400605C19946B0E75542D293966F5953824F15BCD24088CCD00824555204
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 64f08ac9328f108273643a2c6e60b909f94ad79625cf6256d9cd20ed90a02002
MD5 980f3ecda459ded32b092c0512a77dda
SHA1 55a2406273ceb87d4fd6c7961c3bd3ec1a3b1359
SHA512 ac3a4aa50276120c172df4e351f62b5f33ea9c4fae4cff799131ccc5cf7da392bea2b38afd9669a61bcf167825292054baae45eff0e08641a561ae91ad182fa4
SSDEEP 6144:ZbFhZSm9fuSX7joPn32RujSKf+hFD+7t56OD9ZfSApprz:ZbFhXMhPGWSKfyFSXD9ZfS4Z
TLSH
T1694423257F05DD6BCA786205E727730A8A317CDC8DDA7D898095BF9F509AC8C02B3A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 fc4e08cf9b4a1a9b80714f4644eb0e3c423c06cfaf2f17fd30a37a7e1beed3cf
MD5 acdfc7a01148c690dd813979824350e0
SHA1 cce066ba891e8c93a2c27c644724fe49fd956cb0
SHA512 9dd633e62cd78a2f8d87b1a4d7365aebd33dec80321ae31bb540a3801d8ac3b7fcc617ac95743de681f90066f019b432569be6d6819e36542de781aca14fe81f
SSDEEP 3072:f+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:f+hFD+7t56OD9ZfSAppry
TLSH
T1DDD31232AA91C8BBC9BC6541B257A304DE766CED41DE3A09444A5F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 b1f5691d7c0e983818195e2466481afeaccd0fe8f86e413e882efd44ac84290a
MD5 f04a965473cd7b860779e82669ddc951
SHA1 f0805e2f3762e9f9e2b59e8d66f86526c3b96ac6
SHA512 a0bdda96068dabf5e3a60fc44b50f7b1ef51b961a6a58fb3fd16e8581782607ad25dc262d6563574548a8688c4b207c85b08e765a461ecba4e74f26cb7359d8b
SSDEEP 6144:lbFhZSm9fuSX7joPn32RujSKf+hFD+7t56OD9ZfSApprz:lbFhXMhPGWSKfyFSXD9ZfS4Z
TLSH
T1C24423257F05DD6BCA786205E727730A8A317CDC8DDA7D898095BF9F509AC8C02B3A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 d72bece0e3a0a769b58bfbcd9f064443a21c62caf7823bc1789af4ea9be3945c
MD5 a58bdb371bd2ad02af63f87875c360db
SHA1 1bbf11fb975b4179e368287405c5eb94d9147b76
SHA512 8d1e9df58000826e96d2a427498994566ce242f14d0f480b2c78d161e45aed83de20eb1fadf5544d67ee208a9d8c15d3980645031fae39be44d151127befb7f4
SSDEEP 3:MsEllllkEthXllkl2zEklcYKl:/M/xT02zncnl
TLSH
T1414404047FC40405CD1030314051C7D30370D45407335753345104575DC5D400C030C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_l3hcxura.mjh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3hcxura.mjh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3492-19-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/3492-15-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/3492-47-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/3492-21-0x00007FFCD0E70000-0x00007FFCD0E80000-memory.dmp

Download

memory/3492-20-0x00007FFCD0E70000-0x00007FFCD0E80000-memory.dmp

Download

memory/3492-18-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/3492-45-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/3492-16-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/3492-17-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/3492-48-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/3492-46-0x00007FFCD2ED0000-0x00007FFCD2EE0000-memory.dmp

Download

memory/5180-11-0x000002D453F60000-0x000002D453F84000-memory.dmp

Download

memory/5180-10-0x000002D453F60000-0x000002D453F8A000-memory.dmp

Download

memory/5180-12-0x000002D4512C0000-0x000002D4512D0000-memory.dmp

Download

memory/5180-0-0x000002D4512C0000-0x000002D4512D0000-memory.dmp

Download

memory/5180-2-0x000002D453340000-0x000002D453362000-memory.dmp

Download

memory/5180-1-0x000002D4512C0000-0x000002D4512D0000-memory.dmp

Download