ae921064d3ae3bf9b21a5c3c93160acc5fc1c88517927919b519b675d896672f

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 06:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tigue.zip
Size 153KB
Sample260930-gvdlrsshle
SHA256 ae921064d3ae3bf9b21a5c3c93160acc5fc1c88517927919b519b675d896672f
MD5 211285abd1cdf335b324ae801808001a
SHA1 dbfc4a6c23ad37e3f311a490d0d78045f0354524
SHA512 b87e526614bbe033fe48aaa22f707a9ee7f277c24e8734975c7258a9bbcb629d02d7bfc7a3e2bbb662d10eebb25a43a7ab9bd935260999513db6d7ef7edd88e0
SSDEEP 1536:a6qbopMrUI6w6SEen6ibnHt2dArkPPULnjyGzZq4ObnKYfrnonsEOrSSdIHj4Tj2:cMpGUO6Sbbnjftq7mwos2g2
TLSH
T1E9E3F672560B44ACE312A9FC8C594C42F7F6B84783A0D7EF1790A47B39A56C0EBB6D11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4760	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{1F9083E6-0260-4F20-9981-E34ABAE76C4F}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
2520	chrome.exe
2520	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe
Token: SeShutdownPrivilege	4924	chrome.exe
Token: SeCreatePagefilePrivilege	4924	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe
4924	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3504	4924	chrome.exe	96
PID 4924 wrote to memory of 392	4924	chrome.exe	97
PID 4924 wrote to memory of 4760	4924	chrome.exe	98
PID 4924 wrote to memory of 392	4924	chrome.exe	97
PID 4924 wrote to memory of 2892	4924	chrome.exe	99
PID 4924 wrote to memory of 2892	4924	chrome.exe	99
PID 4924 wrote to memory of 764	4924	chrome.exe	101
PID 4924 wrote to memory of 764	4924	chrome.exe	101
PID 4924 wrote to memory of 5116	4924	chrome.exe	102
PID 4924 wrote to memory of 5116	4924	chrome.exe	102
PID 4924 wrote to memory of 3832	4924	chrome.exe	103
PID 4924 wrote to memory of 3832	4924	chrome.exe	103
PID 4924 wrote to memory of 388	4924	chrome.exe	104
PID 4924 wrote to memory of 388	4924	chrome.exe	104
PID 4924 wrote to memory of 4464	4924	chrome.exe	106
PID 4924 wrote to memory of 2448	4924	chrome.exe	110
PID 4924 wrote to memory of 2448	4924	chrome.exe	110
PID 4924 wrote to memory of 1724	4924	chrome.exe	111
PID 4924 wrote to memory of 1724	4924	chrome.exe	111
PID 4924 wrote to memory of 856	4924	chrome.exe	112
PID 4924 wrote to memory of 4900	4924	chrome.exe	113
PID 4924 wrote to memory of 4900	4924	chrome.exe	113
PID 4924 wrote to memory of 4464	4924	chrome.exe	114
PID 4924 wrote to memory of 4464	4924	chrome.exe	114
PID 4924 wrote to memory of 2992	4924	chrome.exe	115
PID 4924 wrote to memory of 2992	4924	chrome.exe	115
PID 4924 wrote to memory of 4996	4924	chrome.exe	119
PID 4924 wrote to memory of 4820	4924	chrome.exe	120
PID 4924 wrote to memory of 1808	4924	chrome.exe	121
PID 4924 wrote to memory of 2520	4924	chrome.exe	131

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\tigue.zip
1⤵
PID:3772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffbbc8c728,0x7fffbbc8c734,0x7fffbbc8c740
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,13348863434384640798,2810295249710583999,262144 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,5833253056093129843,17304617734899582804,524288 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,17352696824509721641,8171317515992471295,524288 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,10600097674096825487,374988823403716979,2097152 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,15135263868246726215,9263877926070527369,2097152 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,2647613408188923803,8550909456604689737,2097152 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,7911866767287616619,14967857846249443349,2097152 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,5639753886412358285,7393705653894164668,524288 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5840,i,4002731056644635289,2398354675053445580,2097152 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3408,i,509957646785006418,9998277849731967887,2097152 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,18069467111437077362,11876548739230107238,524288 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  - Modifies registry class
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,13338676076408530854,7479207420012133930,524288 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5944,i,2833577198321291755,881010469375874567,2097152 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5772,i,12837895122576143088,15730817388568520696,2097152 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,1130219651963363469,3271179206385499307,524288 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,15658124841345044066,13486187115494833707,524288 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,3552030066911283372,11214845544385588840,524288 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4580,i,3931158983402342518,8838935885543480157,262144 --field-trial-handle=1952,i,4745196321695298968,14194360251816089039,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0d085aacc8129c6e269614c2ff070e368077ceaa2a3806649c09cc0baaff68c8
MD5 99ee9323cdd0c36262354aa903771899
SHA1 1417db5817b3cb406706237b507037521ff63ecd
SHA512 dfdf56033e609f5312d8e6196ed4bf40ee56613dd1da2885572d6a41c5759b058c5d0e4ecd91c77130799b1cc8b4944acaf51ec4045fc6a2a027bafc00ed9fa5
TLSH
T140F02DE9DD20EC3718FD1B2960640B46E740135B2680495F3A3D511D8FB063B8586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 bab4026ac0d536cfc6033bd77f8d9e6859d329a9113e125802449f9e65198cc1
MD5 9aa60d8f539fdc0e93aad0205ccb4a0b
SHA1 e9747120a645f2ebefc76d6810fc65803be3d754
SHA512 e175ac3c95822cd898c1b1e5959394137948b636c806fcb8d7070d17e00a4e1a6623c061e22cbd6343229a9625d32cd6b5f73871816d6b2105cfdef8a70c3411
TLSH
T19321ED63F1E38E45DB8B323730AAC810452A0DB0C50AE73F0DD6B0B43DCAAB81225317
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 a0ea6423dba2261b3e6f6b0ee2f7cb89334b3009187dabd6fd9201e1666a09b0
MD5 beac5e53efc9e64e596eeb13d42ca2b2
SHA1 aaaf582c0cef595bcd449d93fc4d81af0fd729e8
SHA512 bc17a42b44fc259bc6b532571a1b759690fb1ec85e18b2205fbc60d17680e9ab8e2a52b2f8d40461832464081f77358e50fcda033861d1cc6ba6e1ec39715a5b
SSDEEP 192:D8LMr1iESyJlJ08Jw+jusXJSogaPxrcNPKvHxbfP/4X2/J0al9:D8LMr1iESyJlJ0Yw+jusXJSogaprcNit
TLSH
T10102ACF7C3D8862DC851D6F4AB256E1FCE2D0A18821C3C66C8D9EE5B93E2471E25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ba516acd46569ddc401990fe24040aeac29330a6fa4f32512459bf8335fd1e57
MD5 12e656b952b82405a3c8de25ca943581
SHA1 ebcf4a237c52b419f008d33c63bea1bf1f8f2b7f
SHA512 691a7fe6bc8aa868e2bcfd65205bff8a5489448f6fbc4fb207f7653789b2d0c9a37e34effa3a89bc3d6a0c033fbe60f2b908cd6e1b4681d5d99e3eb4a5f131bc
SSDEEP 192:9RSlcBhb1R1f7v7E0spuPRp4k3H8v9+Hsb+WN0ScTCrI+vUe3B2ae8Q+VyIsnAUp:9RSlmhbtDQjeXXmUwMtxeR2H2e
TLSH
T18352C62EA820797B5CDBC229F9667B67D3F1202520942EC4EAFC893C14E7ADC6217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e998c86c88beba9c13ca3232d10f43b50e502c8d6b41c95b41667ec645dd7d7f
MD5 cee675355671ba004a5f9151f92f29f7
SHA1 c4338d41e683f3398d9f4ac63cb8ec179706c29d
SHA512 c3b26cef83927376972f64f2507b9404611a39705d5ed245d505e2f43ba163bb0caa4522829297a4c2f222c4f06a9075aaab926a81be02c3c619bfec44225f87
SSDEEP 192:9RSlcBhb1R1f1v7E0spuPRp4k3H8v9+Hsb+WN0ScTCrI+vUe3B2ae8Q+VyIsnAUp:9RSlmhbtFQjeXXmUwMtxeR2H2e
TLSH
T1C252C62EA820797B5CDBC229F9667B67D3F1202520942EC4E6FC8A3C14E7ADC6217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3e4a48a89e9c03efb0087869ff70bcb8fcd0d6f0fdc165813ce73d31d8071dd5
MD5 907e9562b455bb1e99e2bd31736b01ac
SHA1 a28b7039a054a2e59e75b6fcedc6f92b95b7d05a
SHA512 e0384b37911fc4d24493607502830e5510838b310dffaa74b64b1415b454cad68571a35e3add5faaf3873e785d41f306828d91627b4798f79fd06d8d8fde0ae7
SSDEEP 192:9RSlcBzb1R1frv7D0spAPRp2kRoq9+Hsb+WNncT48j2vB2ae8Z+VyIsnAUgtaJ:9RSlmzbtTvjUXVUw8j2p2k28
TLSH
T1B442B62DAD20797B5CDBC32DF9267B57D7F2102520942E84EAF8893C14E79DC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5d177230f9b518c12e0b7f4afc6dad427e25f44f94c739fb99bdf08f9d6d636d
MD5 9c53f81c50a6058622adfcea472c9cd2
SHA1 6dd06acc9d76842bd5c89a9f181c24ab0d50a3d0
SHA512 f01ac0c762b832324757f4fe341bbe68590c4c68ae5dee982a092f7519c9bc3358166c039b5a4c2a0a0cfacd8ba89bc38fdc5b8048acb2ae48aa30888def47dd
SSDEEP 192:9RSlcBhb1R1frv7E0spAPRp2k3Hr9+Hsb+WNncT4vUeyB2ae8Z+VyIsnAUgtaJ:9RSlmhbtTQjUXVrUw8Le22k28
TLSH
T1E642C62DAD20797B5CDBD22DF9267B57D7F2102520942E84EAF8893C14E79DC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 06be13aa07944c67af156a64a7a567c98d46215d0d0f68a1e2312a893afb84d2
MD5 459c43982097f5de2a9502456296fd72
SHA1 0af0168523ac0a442637cd9987d6dca7c913d7c8
SHA512 f3d33fa8326b3a1384b4dab9d8025a5a97c94c1829acfdbc45f2d75c742dba458034fb02d08d541bddc42ea3ab2c6049aa06430582eeb2c5034a2321add39e54
TLSH
T122B0120980412301C04103701151905536608F35F313139581E06D82D83537051A7248
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c48.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591c48.TMP
Size 96B
SHA256 58e9f62c5c37a2bad316ed384612c6fc136476145c15e6da95155bf776b81fa4
MD5 2f610dfd7cd2f9cd07db6d417ed3e037
SHA1 226db60350de91ec9ca0db6b77b08cfe4670101a
SHA512 ed35b7bafd75f28a96d723c0af57a1c18bc312dc4b3ccaecea44f480abd169670f480b6201895709b6b7423d9193c6c9270a312c7e53537d60a755cef532421c
TLSH
T153B02200C00222C2C88223B2B38082FC32E0CF28C3030203C2E00B32EC2A330C0A0220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 602a94ff5aa87f1eb6341532bd8947c99c0f166e76df0f189d69f816fbfe3b92
MD5 d9fec8932116b5f7db31004f5d856cee
SHA1 e3e5cf208664da111f14728acf2b69fb729f8f09
SHA512 3e7a83a90cb12e279690e26c587b2a938aa0cdadb8cd4b526807f366964dd0e85dc477c0305acd8e9857a26d81ad3ebbe20d2237699774a2f8800a8ee8d1d066
TLSH
T19CB011C22282AA03FC0003B08AC008A82320B80B0203883282E20038A820282828AA02
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 7b272157ce1cc3affeffe40f1c0d08cf61088307008b00c49bf38884cd9f4e71
MD5 dc084948b9fa92915b159fbc20955df2
SHA1 53c61b58cf3a230a1944438698301f32c21fc280
SHA512 62e5573f53476690a0231fcfb8eba08cf18eaf391fcab6fb7675c4ee685b570284971301211b7c003d60de7e51aaacc2c853d0db99148770bcbd454cba0b5744
SSDEEP 3072:a+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:a+hFD+7t56OD9ZfSAppry
TLSH
T12ED31232AA91C8BBC9BC6541B157A304CE666CED41EE7A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 98a6c821f757eb175c2a94f425e5e5fc4cc07ab1af93e99c2c9dc43b905fd9da
MD5 062b68258fc073b151f1100297424d35
SHA1 5a56572ba9af0e02afbc2a3ae40c57f366221095
SHA512 c0fa5bcd1403831ae0b2a65f027a4d6b3cdd879845a814ff0dd9353405222e7a80ac7206ecaffc475ac3fa1a04bd20ba770b1fba157a2de3e48ffd19d66283c4
SSDEEP 6144:lQrWMy4s+Je+Otv7eSOu6++hFD+7t56OD9ZfSAppr8o:2iMJs+YlKSh6+yFSXD9ZfS4+o
TLSH
T1CA4412723657EEFBD9782102A00B62045DE5FEF892E66E5544C19F4DF2EF44806B3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 24ae094f1cfc81d778a84384369dc228425b6ad67716081ec9a40bd57c7c3281
MD5 793dbfc2e208586e1d1d31b64942ba8e
SHA1 1e87eca7d532cbe46b127997375cbb0e2b116f0d
SHA512 0f08e541c2e7ee11564a2ae66e283effe92a3f3e1f39814bd01df8ffe701691c07f821d4ffe03c0c3b3f283badfe90235ad09af74e8df538ae2da2e8e1059c9d
SSDEEP 6144:gQrWMy4s+Je+Otv7eSOu6++hFD+7t56OD9ZfSAppr8o:PiMJs+YlKSh6+yFSXD9ZfS4+o
TLSH
T18E4422723657EEFBD9786102A00B62005DE5FAF892EA5E5544C19F4DF2EF44806B3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 793778e1f109d74157656cba1912f62bd991e1201c21e5f59831fd6e566a73d9
MD5 caef029c1f00ae49e0d7a3c7d5e93d33
SHA1 72821361e9f7434b654d9c303f87957c61d920cf
SHA512 497a04cb38d99752b25b60f970dd5fc69b29a49c05cc69c7da4f7d78ee6acafdd9498d783fee0220941d5ed579c69da9973d989204276bdcbac4b4efeb47d0bb
SSDEEP 6144:1fQrWMy4s+Je+Otv7eSOu6++hFD+7t56OD9ZfSAppr8o:OiMJs+YlKSh6+yFSXD9ZfS4+o
TLSH
T1124412723653EEFBD9B86106A00B72005DF5FAF8D3AA5E5944C55F49F2EF0440AB3A21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download