hxxp://uni-fix[.]at

Analysis

user interaction
yes
max time kernel
88s
max time network
89s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://uni-fix.at
Sample261023-pfa64ady4k

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4944	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1836680733"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{98A0F1EA-CEDB-11F1-8DE2-D20F7D904631} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31285992"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806c9bd1f062dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1832360632"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fec0338b133e6e4ebd6f90c9fac022a2000000000200000000001066000000010000200000006e00442213ad736d55cf2fd32d219a1785809b889b82c5d330ad5cafadee0cbd000000000e80000000020000200000002b642578fb4e21886a530489645c76b445c8e7ad1c5ec5da6bc2fd68d90a660620000000d25c31a95685685a430c4ddd21140ebb4a51c9dea04dbed9575b4c61b1b653b740000000f41a604f7db030328e27177b95c8d5e4bad5a69ce3baf2185cd64aacdbc59e3a24140d7dea1cf84a1f06c83ee9e3486d6bc87524fc31636e76132c20c3e13571	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fec0338b133e6e4ebd6f90c9fac022a2000000000200000000001066000000010000200000000f5cfbcf53d1cdb4f2d4536ede3d6885053e1ace708be8a591241e2f65e32c16000000000e800000000200002000000096c0ac5d794d83393c1e24d096c60c4da4556297f9e225292408b5b813e81b6520000000decffae3e64fcf6999bb0f40e7d6a61068a6ae4ddc7665a49f516a580b4625b240000000373c27395e12a6318f1a45e07282e71f9e587d978fb62627f847407cefa03dd51f907f0f2371850a23864af9027d9e7515cba28719a5ba94d3c774c6b191ae57	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80dd9dd1f062dd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31285992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe
Token: SeShutdownPrivilege	2676	chrome.exe
Token: SeCreatePagefilePrivilege	2676	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2724	iexplore.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe
2676	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
5104	IEXPLORE.EXE
5104	IEXPLORE.EXE
5104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1796	2676	chrome.exe	85
PID 2676 wrote to memory of 4944	2676	chrome.exe	87
PID 2676 wrote to memory of 3472	2676	chrome.exe	86
PID 2676 wrote to memory of 3472	2676	chrome.exe	86
PID 2676 wrote to memory of 1996	2676	chrome.exe	88
PID 2676 wrote to memory of 1996	2676	chrome.exe	88
PID 2676 wrote to memory of 2072	2676	chrome.exe	90
PID 2676 wrote to memory of 2072	2676	chrome.exe	90
PID 2676 wrote to memory of 4940	2676	chrome.exe	91
PID 2676 wrote to memory of 4940	2676	chrome.exe	91
PID 2676 wrote to memory of 768	2676	chrome.exe	92
PID 2676 wrote to memory of 768	2676	chrome.exe	92
PID 2676 wrote to memory of 3744	2676	chrome.exe	97
PID 2676 wrote to memory of 444	2676	chrome.exe	100
PID 2676 wrote to memory of 444	2676	chrome.exe	100
PID 2676 wrote to memory of 5072	2676	chrome.exe	101
PID 2676 wrote to memory of 5072	2676	chrome.exe	101
PID 2676 wrote to memory of 4644	2676	chrome.exe	105
PID 2676 wrote to memory of 5080	2676	chrome.exe	106
PID 2676 wrote to memory of 2504	2676	chrome.exe	107
PID 2724 wrote to memory of 5104	2724	iexplore.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://uni-fix.at
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ffe8643c728,0x7ffe8643c734,0x7ffe8643c740
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,15387736988190237475,6066911674941066985,262144 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,1011119785189955348,4029669035025879375,524288 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,11576165078982341982,10731708540218138018,524288 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,16277424342184695955,6382448084328766228,2097152 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,4161725875165817025,15895219510024002943,2097152 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,14210872154831335276,17713093978823924761,2097152 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,6625611131984805341,9384899418899050648,524288 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5288,i,6091072196351884086,13676570425664343891,2097152 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3524,i,17068309377373629021,14459203079434485600,2097152 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,5304790335529032053,2821638818213663947,524288 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,8320870604436740061,5218627119086299162,524288 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,15924836511371798242,12523425955057025861,524288 --field-trial-handle=2008,i,4472091099419589755,12298334072974725708,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4608

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5104

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 d316d9b8b9311267599b9f39ecd945ee9804a7ae0e1e7a1cc4fb4e71a5f23e97
MD5 99cd9f308186002165ff4f3268d911c6
SHA1 e29b1eef225e91b9303c103ff9c49b08e71eb0d9
SHA512 f65eabe5a3bbbc08392c5566354cffeb812f3da3106c2278e032dfadad7b4a776e6af4c846c52d61edec99a18464aab37809f7b10b2e85834fdd4fd47ca68b1d
TLSH
T1B7F0D4E3855FEE51DC7474CC55784709786132F310604012707C15A10079BBB2F8743B
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 a8059306737a7f37316c181fa5c8151fed443266d349647648180c3e9e53bb57
MD5 0020ece4f034f4b9ea6632506409fe1b
SHA1 74bbbb256deed033902e2b180e44db45f0352c81
SHA512 0c4696e708ff7bdd45199648420091c56cba44109d6a00de74c8e1dd5b59642898f086101bbf1a144b630e6df92b84fc906616f2b108c72e12835a8d6acb8e41
TLSH
T1DBE0C02812FA812FF0E4E4344BC5F422845DF0371919A3B42DC44F08BB06B40EC03A26
MD5 SHA1 SHA512 TLSH

Submit Download

136dfb9f-cea4-497e-bd37-5cd0e2e0a09e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\136dfb9f-cea4-497e-bd37-5cd0e2e0a09e.tmp
Size 132KB
SHA256 7259f69accc997804ea52df97446f054a897dacaf6892dc9d49008dd4ecf7152
MD5 93f2b17bfc222724c2e1777d0a211bdd
SHA1 3bab170e6c074ecbe9698bdf282ffb9168cb986f
SHA512 f84d47fac176b1f685b4492450f85f53af73446e87695bd18a42f7f8013b521ada9368f09fd03af164e5648d527e30b1edde1d2610ce1f456712ba735924e067
SSDEEP 3072:UxIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:UdPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T148D302217D45BCB4A9EEDB21A1402A16EAF8D94B95397FE618DE3F4C05A36D9C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17823ffc-496a-4d68-a1aa-ca63a9f8264f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\17823ffc-496a-4d68-a1aa-ca63a9f8264f.tmp
Size 132KB
SHA256 b306fcb2febedbba63c1f5410a96e885c8ee4fd073a81a36be8fdcbf9580c916
MD5 34be5a72f22c0ccb68677a16c9950665
SHA1 2fe7eee49bac23062e8f02de89705b951e6ea1cd
SHA512 d68d3500e1dd7a6b78a8c7898f72b3bf12dbf207a36c2c816d7ec0ad2ad8779a937734d2c0d4965ac98e467e2d016675a2e7ceb1ce397c96270dcfebaadae49f
SSDEEP 3072:jxIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:jdPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T187D302217D45BCB4A9EEDB21A1402A16EAF8D94B95397BE618DE3F4805A36D9C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41e73a17-2010-4aea-9f73-7ca6a754e630.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\41e73a17-2010-4aea-9f73-7ca6a754e630.tmp
Size 132KB
SHA256 ff5947f99355005e45a06731cba0e3dbb1a2bd79575d1d5241e493b32ce241d8
MD5 556a34316e4888bf23d3d38518804b7a
SHA1 78f5bae9e724b96b0f0c0cde2d3b45e0567e1bc5
SHA512 6f2e0a293e8ba84ae65601a9437b8b6332ae580e3115d0011900c6e7c9585d578418c9bb6ae04db4e6509cac3c4c5f2dd5ffa25a97c4792e2facaf1924970b42
SSDEEP 3072:UpIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:UVPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T1ADD312713D05BCB4A9EEDB21A1402A15E9B8D90B953D7FE65CDE3F8805A36D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c802e34-de8b-4e18-bd76-0ffb0727e8a0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7c802e34-de8b-4e18-bd76-0ffb0727e8a0.tmp
Size 131KB
SHA256 7a865b7b818ec4c3c672ebf81a24644de0f077e6506a964b8ab2026af172b5db
MD5 4a220a7f10f2e0e35f8feaeadb655d76
SHA1 e16e2fc737ca2092b5539b007b2ecd33a306ad23
SHA512 d9a9409b5024a3e5de9bc4703ded88e36553a6f93fa733e8c3bf353ac35d1763546fbbe11e615efceb9e038abfffde9efe61ad11bb043d94e668248b4f16c145
SSDEEP 3072:7UIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:7wPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T18BD312213D41BCB4A9EEDB21B1902A15EAF8D94B95397FE61CDE3F4805A36D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d54a0e7-a328-4936-87c4-6ca41b6dbbbc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d54a0e7-a328-4936-87c4-6ca41b6dbbbc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

0db0b246-44ec-42e5-ae49-77d201edbe1e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0db0b246-44ec-42e5-ae49-77d201edbe1e.tmp
Size 12KB
SHA256 74a6c9446b399d1de88c94aa767ec4fa2c80109ddf1eb3e89133e77e1b0c855f
MD5 21ea58fd1b5fabbc8365f9bcd2bf9756
SHA1 b72f0a5859724c3f00aff07d6b1a1af20effe5bd
SHA512 5b973d8b49a5f2991d7d71d09ff1d850626edfd3dae17dfa9d87099d3f702dd10f29188466c8a9bdd6745adb07325eca2efcf5c6f8468b288a72f87d3a736666
SSDEEP 192:uRvWc1B4mIEcDv7AWpAPRp2Cu9+Hsb+WNnzEhFdYf9ry4Z2KVyIsnAUgv4:uRvWw3ozUXAgwwxYF1Zv4
TLSH
T16742D86DA994797B6CDBD229F9217B97D7F9203230901E84E7FC892C24E7ACD2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c4cdb88-070a-43ae-981f-ab0435208668.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5c4cdb88-070a-43ae-981f-ab0435208668.tmp
Size 13KB
SHA256 237d655380036893414609437026f4f3e22019ae417bd0a537cda5b6cb0deb13
MD5 e3ca190bada012a740ae818892654722
SHA1 439b563fac2f4704975a233bb4592860d18cbcc7
SHA512 f0827490b27d4c1fe7a12f38071ec967701ce8527fb4846f6826374c5dec1025501a3bee8c78409d2d882bd990cdd2739fbe8f1ec718765ce5626624f56803a6
SSDEEP 192:uRvWZ1B4mIEcDv7AWp1PRplCu9+Hsb+WNnzEhFdYW9ry4Z2wVyIsnAUgv4:uRvWv3ozvX3gwwxY21lv4
TLSH
T16E52C86DA994797B6CD7D229F9657B97D3F9203230A01E84E7FC892C24E7ACD2213017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cc0e64f-94f6-4102-b715-d53f79be5185.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6cc0e64f-94f6-4102-b715-d53f79be5185.tmp
Size 12KB
SHA256 6fa93acf31e3eca298f8b6ae29b10bebdc972312500af0fa1f6b5b24c702d479
MD5 bad75f2f703a83094ab6240b5831c221
SHA1 82938c97cfa5111e85d8c5a5703084bc39abc3c6
SHA512 6b5f8da7c43e6a7b082507855d8ae6ddab0e721a1449a086a1d0cffddb5ef18fb2deeebe8c7a2067cbfe2af89d691e0eac0deb07f122b589c1cc63db7b389b99
SSDEEP 192:uRAWc1B4mIEcjv7AWpAPRp2Cu9+Hsb+WNnzEhggev9ry4Z2ZVyIsnAUg54:uRAWw38zUXAgww9eV1A54
TLSH
T14042C82DA994797B6CDBD229F9617B97D7F9202230901E84E7FC892C24E7ACD2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fde31c5-a9a2-4e93-aff8-e59886961ee2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6fde31c5-a9a2-4e93-aff8-e59886961ee2.tmp
Size 17KB
SHA256 32e6c0a3f05682d1e24f62135a16a559239bad390f6d29f2c3f6be9606c5db00
MD5 dd640a034f45376f3fcaa0a994fd4c07
SHA1 84453886df3f8873a24f080834e8931fb45a049c
SHA512 f4914452222e94317f3fd39a2a4bf91384dae0f2bcb11a077cd1c0143c27df3b5988a42d81e29fc71842f0242fa488537d4bbb16e9e30f0e2c39407ce6dc1661
SSDEEP 384:nVjD27KxkXqKf/pUZNCgVLH2HfgslDZ7pLuLceSx8XODDS+ErU3s7HG+I4QEry:nFD27KxkXqKf/pUZNCgVLH2HfgsFZ7p5
TLSH
T1D772E8677C4899370F94CAC8D8267F4FACB9025B65ED886553FA582503D4BCF110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 fc7a4b27a7c3cd38c28fbd11115efa60532cc9fcdc803b1b6d6bf652330b8961
MD5 d530934516ad1b8e795a54b957824bdf
SHA1 ce06d982199fbb392a8661c7e6f4450d37fca01f
SHA512 eb829202365076e1e69c611ac88e8ae700c3b7ce3244bdc00c7fb80aed989f5d39b5193267f1f7d5d618ad901d861a0877fdf8461667136757053f7c9576ce80
TLSH
T1FF31C8A125CF2141DFA0433619FA2C563238099896D35FEB066478FF2417FE99F51853
MD5 SHA1 SHA512 TLSH

Submit Download

4e71bb6b-a9ba-4a8d-89dd-d8e800bc4dc2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4e71bb6b-a9ba-4a8d-89dd-d8e800bc4dc2.tmp
Size 6KB
SHA256 cb355bcabd986672cb0ee066f5402769472690b466e9d52abb34086d0e34217b
MD5 7bcd42f614c49b7cc138564ae3becffd
SHA1 be0ea0d061882123c1927bb69e75f2918d9dc3b7
SHA512 000a7d9e15af90882873e7d08934aaa5fbc0ff508d86b418020cd255858c5fc720e45996013ed29811f5fe1e307b30067c681ac99b56ce1d73c63d7005a2df70
SSDEEP 192:DqnB7w/BaIaEd4Ojwv6GDt1qmE6RviUKPZrw0n:DqnB7w/BaIaEd4Ojwv6GDt1qmE6RviU4
TLSH
T1D7E18CF7C3E8863D9D1561F4AA156E1BCE590924432C3E66C8E4EF0B97E2471E28076F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b60d327c-906f-46ec-a31e-16885db50f8a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b60d327c-906f-46ec-a31e-16885db50f8a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 59d8e3988275a61fb496fb921eaca64e8ca837641fc2c9b96d9fe91286b4efd8
MD5 9d5f4b629a8a3300c3012953e12166e2
SHA1 081e31604bf2773c2e543f7e338044c565db7bbf
SHA512 96961cb461b7438fc48849cb57f6458e9316c85c168349ab9a8ad2d29e4cc58e112645f9fc79cc50b6b3cabbf157a4f267c3cbed1bf6e6878c388cd54619d227
TLSH
T182B0120480425781C04202B0215154883254DF10E715174141F40D57D8365B2C05B154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 768adbfaf0810bf1f92c91e0aba7631961a988de0f55894eedd5824f692ba7f0
MD5 951414f776b2cdff5f4b4a935d113318
SHA1 28872f5b63b2f108a89e7f6a7be211dc7fb180f5
SHA512 e26cbef3baf750bdf40349a0a7ac1080d140dd1b93198fc0b0a0995738bf4c87bffd2d44a4e56e61f3c71fd53359bbff83d63dc200205d9800e7dcb07b8b5bd1
TLSH
T1A5B02228C0023203C00A03B020C080EC3020CF30C203033382E00A33CC2A232C820020
MD5 SHA1 SHA512 TLSH

Submit Download

c9841c68-9881-4c7c-a400-471dd80e3f1f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c9841c68-9881-4c7c-a400-471dd80e3f1f.tmp
Size 414B
SHA256 8ee92ec17f98a35747b8f4bd5ca2e7227a0134dc5e040528343952acf2160656
MD5 a345c4626dbcf04f76472c10aa6f21b3
SHA1 2491afbcf91758b30277d0299a4f2eede04498b8
SHA512 c33a3876b00d70108c822dd037a5cd304f30ae76c6bd2d0a8cc2d475eba7eb21dd4789efafe517409b1a87320108f75dee062ebe302419a1dedb22c2e9de7186
TLSH
T175E02BA9C855AC2714FD5F2D5094478AE72813272A90890F3A3C41088FB1777458A95C
MD5 SHA1 SHA512 TLSH

Submit Download

f599ba84-7a7a-4c1e-bd6d-955657361a82.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f599ba84-7a7a-4c1e-bd6d-955657361a82.tmp
Size 12KB
SHA256 0f07c85aa130e0336036c8087ee9911f06fef432e8446478bfc495654d87234c
MD5 a78eb1c08050ea725bf2924b7fd54f09
SHA1 3b0c84ad0bb59c7b18cbec4dd5d87035a3abec5f
SHA512 cb519be0e6370751d5c43b1ca306e7486032d115b89a3cb2fc82fc95c4f23f4008c25dbfad87b3cda510f20fb5a447c22ff5443980170c477851d1d30869cf92
SSDEEP 192:uRAWc1B4mIEcnv7AWpAPRp2Cu9+Hsb+WNnzEhkk2/9ry4Z2ZVyIsnAUge:uRAWw3MzUXAgww12l1Ae
TLSH
T10242C72DA994797B6CDBC229F9617B97D7F9102230901E84E7FC892C24E7ACD2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download