hxxps://cdn[.]discordapp[.]com/attachments/1484000984396206213/1554603422391472298/Debug[.]rar?backend=b2&ex=6abd7cc3&is=6abc2b43&hm=87007d00e10690b5e56fb77e5b27943b21dd402adf764465abafc30855a50948&

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1484000984396206213/1554603422391472298/Debug.rar?backend=b2&ex=6abd7cc3&is=6abc2b43&hm=87007d00e10690b5e56fb77e5b27943b21dd402adf764465abafc30855a50948&
Sample260930-jreqrsxsc1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4848	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
2164	chrome.exe
2164	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe
Token: SeShutdownPrivilege	3352	chrome.exe
Token: SeCreatePagefilePrivilege	3352	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe
3352	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3528	3352	chrome.exe	85
PID 3352 wrote to memory of 1780	3352	chrome.exe	86
PID 3352 wrote to memory of 1780	3352	chrome.exe	86
PID 3352 wrote to memory of 4848	3352	chrome.exe	87
PID 3352 wrote to memory of 4268	3352	chrome.exe	88
PID 3352 wrote to memory of 4268	3352	chrome.exe	88
PID 3352 wrote to memory of 2164	3352	chrome.exe	90
PID 3352 wrote to memory of 1672	3352	chrome.exe	91
PID 3352 wrote to memory of 2164	3352	chrome.exe	90
PID 3352 wrote to memory of 1672	3352	chrome.exe	91
PID 3352 wrote to memory of 1648	3352	chrome.exe	93
PID 3352 wrote to memory of 1648	3352	chrome.exe	93
PID 3352 wrote to memory of 3276	3352	chrome.exe	94
PID 3352 wrote to memory of 4516	3352	chrome.exe	96
PID 3352 wrote to memory of 2864	3352	chrome.exe	113
PID 3352 wrote to memory of 2864	3352	chrome.exe	113
PID 3352 wrote to memory of 3492	3352	chrome.exe	114
PID 3352 wrote to memory of 3492	3352	chrome.exe	114
PID 3352 wrote to memory of 1324	3352	chrome.exe	115
PID 3352 wrote to memory of 1324	3352	chrome.exe	115
PID 3352 wrote to memory of 4264	3352	chrome.exe	117
PID 3352 wrote to memory of 3340	3352	chrome.exe	118
PID 3352 wrote to memory of 2888	3352	chrome.exe	119
PID 3352 wrote to memory of 2364	3352	chrome.exe	121
PID 3352 wrote to memory of 2364	3352	chrome.exe	121
PID 3352 wrote to memory of 4324	3352	chrome.exe	123
PID 3352 wrote to memory of 4324	3352	chrome.exe	123
PID 3352 wrote to memory of 4664	3352	chrome.exe	124
PID 3352 wrote to memory of 4664	3352	chrome.exe	124
PID 3352 wrote to memory of 3648	3352	chrome.exe	125
PID 3352 wrote to memory of 3648	3352	chrome.exe	125
PID 3352 wrote to memory of 1132	3352	chrome.exe	128
PID 3352 wrote to memory of 1132	3352	chrome.exe	128
PID 3352 wrote to memory of 2164	3352	chrome.exe	130

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1484000984396206213/1554603422391472298/Debug.rar?backend=b2&ex=6abd7cc3&is=6abc2b43&hm=87007d00e10690b5e56fb77e5b27943b21dd402adf764465abafc30855a50948&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe4ffcc728,0x7ffe4ffcc734,0x7ffe4ffcc740
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1796,i,13148763061777485270,8947134981212346810,262144 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1628,i,1353555332617359188,3431094870776707784,524288 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,12758332752251702931,1044869704681197868,524288 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,4891857747035276344,2163262196396119385,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,5159431041519072844,9704589500549037693,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,12527599427356300938,5120932421368538282,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,6400426640589098439,5311834869387139448,524288 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,16890741805367650044,2625909858111969328,524288 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5360,i,15759783015716038317,11754514657600428650,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6020,i,16612707534967240855,4550898704969681501,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6088,i,2350288088180604209,7012573816663905142,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,13961590225087423424,7693877672482448157,524288 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,6513644800758305833,1516265049369755131,524288 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3256,i,5500503449135314,13898459781028423285,524288 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3240,i,233279681259363144,2132172391991587803,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6200,i,9630535541234232252,16494084364168558282,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6264,i,16930109461225053254,9023821940478438289,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6204,i,7862770679506166182,12633215817235174970,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6308,i,14070228766693716313,14634905773179462322,2097152 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6204,i,16651401056878557129,12327206253097702127,262144 --field-trial-handle=2020,i,7777789472922729765,9842970720088668234,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

97b955bf-c367-4505-baaf-132ceb5612dc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\97b955bf-c367-4505-baaf-132ceb5612dc.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 72b3dda4ed2003bf9eaf1ee9682e03d4fa1f7145460b0bcb1a161fe22309ffe7
MD5 14809fdbfa1f1d921c8ef3b5049d285d
SHA1 ee58242c72df0f43eeb431099c39eca01122b9bc
SHA512 26c3ee009dd8c1fdc1c04fa594d15e309adc1cf6024bde57f0836de9b28ed88059cd39c8ef5f0e3beb758d0cb24849455f8349d5f95ccb04aee262845ca5eb44
TLSH
T122F02DB9CD22EC3718FD0B596095074EF74113672B40894F3B3D410D4FB463B468A85C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6aea49ba4c90d73fcf8988e6963b75ab3425e20fd4730552da9701a7a334398f
MD5 53bf4fa66f342e7afe1cc9b724cce797
SHA1 239f117ca01c48ed5e861bbae15d1c3692c0f5a9
SHA512 f49a33a118c65ea882f882264943959abd7eac138590489b61564f2474540290c8ef27c28f7af0a683ad9a1009ccd4faa8913aae0d75e8cb289ca2a87a19f4f7
TLSH
T1B311669C2481B933EB8CDF3155EB006F297706676604876C8683F804BE6CFB90E0439D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0981fbce0da168b9371f31297ba32a7c04c860341e12d906f0068afe1f92aab4
MD5 3129cfeff7bb8ffd4c0e57ecac57f420
SHA1 2f4166fa3d1e9672109ddb16fe4912a71da13b8c
SHA512 d7e2b54c3ded4feed2577859bdcc807663d6446fd61fb51e18e6ae81aa2f705b63391ea844c2f4a753723ecb1dcb8ce80c48060b419a918ba06f53814cf05d8a
SSDEEP 192:DzxVgIRSqE/bJcawuZ1fWX79v/EjySIc3jaP6v+kfP+NPyE:DzxVgIRSqE/bJcawuZ1fWX79v/EjySI3
TLSH
T105F16CB7C3D8CA2DC85556F49B25BF1ECE2D0A18432C3C26C8D8AE5B93E2871D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 91fb752fe13df8bb4155613d2aa97a54f4311dc17b7992aaea8019fb7acdff5b
MD5 f92f644bfe0a7765314831c316a8bd63
SHA1 6cace709d65bfcfe995215fec30178a82c8e5101
SHA512 87cfc4c0fb43894b2c3964a4427d290f0e3bbbe5b5e78a8060667b925521cae9e317cd529de853e3f20556eadabb7ad1b3adf00a88c48591cfd95a0e60a32f1c
SSDEEP 192:AR2cBzX6Qz77p+v7+hAPRp2hps9THsb+WNnrB4Xdewk2mMkwwvRVyIsnAUgE:AR2mzXJ6a8Xp9wtKeB2rQPE
TLSH
T11242A32DBD10793B5CEBC22AFA627B57E7F5102160941E84EAFC893C15E75CC621B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0cd41304ccbe71af2de33ad58a945632d52e83ae5e5f2a39381a83a19803c18b
MD5 c46fd88384831d030d7c4cdf15ae1351
SHA1 e2d878d790e8e79e830b02550f3f9b32c1d3313f
SHA512 3929ec0ae0282d0ae14a16f4998acc5f34e8ca89ad5a83addd666a2a36f658c942d6acacdad4c831dae00f8a45231551a3650911cf7e40330c3e509473873020
SSDEEP 192:eROX6Qz77Knv7+pAPRp289THsb+WNnhoPlk2mMkwwvCVyIsnAUge:eROXqvaUX79w+Pa2rQqe
TLSH
T15542922DBE14793B5CEBC22AFA627753E7F5102160942E84EAFD893C15DB5CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e4ec8e69d158aba2cc18a36a940a5d8cc75cc80badab476df49a1132e05faa89
MD5 11a3abf7c51427219b272310a3c7b7ab
SHA1 bb57a5c6b85086c6bddff783a667f1dee11b7dcc
SHA512 6fe53f26d2cab1feba29329d10c853d6d7cf5fb5e3099a0ae083376bb7207459107b01dca5d524afdc7090dbad3b58787e1e2fc391ad41645c0f054ba59d44b4
SSDEEP 192:AROX6Qz77pxv7+hAPRp2h3n9THsb+WNnrB4p32/k2mMkwwvCVyIsnAUge:AROXJha8XA9wta2c2rQqe
TLSH
T13242A22EBD10793B4CEBC22AFA627757E7F5102160941E84EAFC893C15EB5CC621B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a4c64a684b88b3fd998e74434dfea6c6a3413d25b6dc4732f8a754006c6835e3
MD5 31fdc361d3d8b9178b1f170e4d5c3001
SHA1 48614c02955207015f80563cbfe1bf9f3662c319
SHA512 cc48bf5e52923f644db82fd44ab60015cd41573829359c0155b5fb8b6eadbc6b00e6240332b4498452953b7596005b78634f45ec835f6ba2df8408d085b43382
SSDEEP 192:AR2cBzX6Qz77pyv7+hAPRp2hps9THsb+WNnrB4p32Ok2mMkwwvRVyIsnAUgE:AR2mzXJea8Xp9wta232rQPE
TLSH
T1E542C42DBD10797B5CEBC22AF9627B57E7F1102160941E84EAFC893C15E75CC221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6874d4ef12eca98dde014a83a67d8d31dbe0116c8955ed4e9b94b7c7a9d8f22c
MD5 d562f617774ee2cd79570b4fcff527e0
SHA1 b46880b5edfb8f26253b52d9c88e20e36e5b6202
SHA512 535bc5b0b972da981d5ced457e076eee051544058d3ead3f81f7a74648a2dbd9ea521ebfb54930a964a05d439cba875c18a0991c1d355df8d2a9bd4be98b7271
TLSH
T178B01248C0926702C01602F41158249D3268EF14A609130191F40D1198391A0915F078
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596efc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596efc.TMP
Size 96B
SHA256 6652ddd60f090aa1ac41238033dc9762563ec579a5e21250571577762a639b0b
MD5 fcc2f5754ee5777739a8121cef1d327c
SHA1 9f16b5b7568a50416d8b504148a6d9a38b6f665b
SHA512 33ae6daa00c3f7b555068fd2b2702ab91d738365cb28c6f441c41e5c07c7b9f93acc69a795216ae578c402013abbc00c3399072934e40889bded32c14fd2575e
TLSH
T182B02208C0022223C0A203B02ACCE0F8B0B0EF20C203220AE2E00A32EC283300332220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 d253869a158fe6856693deb4ae885ebd392c753f61064acc16c6969e7cc17c62
MD5 b3d4f4d7535131f86f0347d5d7b711fa
SHA1 6d5b9c135281318c38fc3c67023923472c92ca6e
SHA512 8cebd16df2c9e8aa43c4d8a564ae63bc4781a7f5c632ed135c70074a9c50d6462dcb6622cd2ff84725bb65b7c9c05b6da6f6cbdf07b94e1d304a612e2ab26537
TLSH
T194B0228C0088CC22CE8803F022C00C803332EEC0B38302B33AF0808BF002302A3CE020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 5abc3f1563b8c66e193532228916fdc4511667b222939d0b99e195090a0e85d1
MD5 efe0998c0c1c79d7e548df1e09eeec7c
SHA1 02d6ccb130e1931cd73a8df6160e019027a8aa90
SHA512 5063ee72937fbea53af6f0e8f7fa6122f07461fb64029fbc8d0dd801e1c36f5496c934312bd8b7c39673a6aa3580877137c7c3c956bb73d3ae1531bb6595586c
SSDEEP 3072:7s+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:7s+hFD+7t56OD9ZfSAppr2
TLSH
T184D312326A95D8BB8AFD6541F157A300DE62ACED42DE3A0984465F8ED09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 616bafd19a3d79d459fdec2236d4092e99a78cfaac9282e90f83efb7a3f48bc2
MD5 56014c6b22acf17d353e5ad3cc15d018
SHA1 e6ca55c37360c503551e356ced74bda212f33740
SHA512 5b66c60d62895b82683904454a939952e21ab2dd894ee6569d1a5d5b84725dd7c141db75e510e8f34cad83b67957e157a829f62c89e9d98789c80a52af20c627
SSDEEP 3072:L+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:L+hFD+7t56OD9ZfSAppr2
TLSH
T16DD31232AA91D8BBC9FC6541B157A304DE626CED81DE3A09444A5F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 15716e12fbe89d5907d87b95a8c6f9b917afbc8cac2f944b5151acebafbbce1b
MD5 75adb3cc4f3c5bb9debb8bd3a8b295f6
SHA1 97a2373dc7167102563d82625b040ae3d5c2285c
SHA512 06ade249d780c77efcf343793c0df58b28065181c8c3948c5feab39591cece7ab85626851454c3c2ec98e8501f1067402d2d4fb4027bae33bbf89ce555662643
SSDEEP 3072:Us+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:Us+hFD+7t56OD9ZfSAppr2
TLSH
T121D312326A95D8BB89FD6541F157A304DE62ACED42DE3A0984465F8ED09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 d9770a35d4e14dbb5e809a09e4cc2706390e18a659e58aa7e560430cbf6895f9
MD5 d4c94d9149435b26f863462673c1b1c1
SHA1 80f826c4cdb08b3f51224b5248a6423b71e4f9f5
SHA512 a0c3a98926770e6f5fca358aa2341ca4ab87b55701578d78ed5804d6f6060710320663d3debfc856771a7dfea8271a86b16c3f35431a988b7f7657e2fcbcc034
SSDEEP 3072:Is+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:Is+hFD+7t56OD9ZfSAppr2
TLSH
T1E1D312326A95D8BB89FD6541F157A300DE62ACED42DE3A0984465F8ED09FC4D0763A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 0f436061b1b37174dd420e6c4093a7dfc108d91117093d708c1966f8a2920317
MD5 1d55be38f2894740bfd95b4d8a1e88ba
SHA1 76e3014810b39ccb5fbb0bcd4b58dd0ae3b1b818
SHA512 c0bae9bb921d1f04812e65235792dc3f8802dc7291a1d6c2011a0537a3632ce55b2118a13d9bbfa2e2aee76608f87eab648693fc3d55a3ff89093094c492fe32
SSDEEP 3072:KL+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:KL+hFD+7t56OD9ZfSAppr2
TLSH
T16ED30232A995DCBBC9FD7541F1476304DE6668EE81DE3A09844A5F8A909FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download