d4f2ddb039bfbd1bb9c617684d4e287a6493d6b229d7c53ff36e780c74b51d4b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pyv2.js
Size 57KB
Sample261024-ct9klaea79
SHA256 d4f2ddb039bfbd1bb9c617684d4e287a6493d6b229d7c53ff36e780c74b51d4b
MD5 0a7e43e991480de4b388450a0e986256
SHA1 4352e2c085ea825752456765565927018c7ede78
SHA512 cfeec943f9797952617a35f0e4b6d5d92ea98b5be4c3cacacc6c42936107a87a08df1f7ef4bfdd011a4c060bbfe04ab5b1ce036ee92086026919c1b4e46b5fa9
SSDEEP 1536:Tkb0TZRBHLpRhODvuhwlIZR69wT6BUPLU:S0TvRLpRhODvuhwlIZR69wT60LU
TLSH
T13A4340886EF798524253F0781F476809F2348427A18DCEA4FA4C95607F96425C6FFFEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
108	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2196	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{113D5B52-8E7A-43D0-AA28-20A0440251E3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4620	chrome.exe
4620	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe
Token: SeShutdownPrivilege	4512	chrome.exe
Token: SeCreatePagefilePrivilege	4512	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe
4512	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1692	OpenWith.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4804	4512	chrome.exe	98
PID 4512 wrote to memory of 4084	4512	chrome.exe	99
PID 4512 wrote to memory of 4084	4512	chrome.exe	99
PID 4512 wrote to memory of 2196	4512	chrome.exe	100
PID 4512 wrote to memory of 404	4512	chrome.exe	101
PID 4512 wrote to memory of 404	4512	chrome.exe	101
PID 4512 wrote to memory of 2804	4512	chrome.exe	103
PID 4512 wrote to memory of 368	4512	chrome.exe	104
PID 4512 wrote to memory of 2804	4512	chrome.exe	103
PID 4512 wrote to memory of 368	4512	chrome.exe	104
PID 4512 wrote to memory of 4140	4512	chrome.exe	106
PID 4512 wrote to memory of 4140	4512	chrome.exe	106
PID 4512 wrote to memory of 4680	4512	chrome.exe	107
PID 4512 wrote to memory of 4272	4512	chrome.exe	109
PID 4512 wrote to memory of 4272	4512	chrome.exe	109
PID 4512 wrote to memory of 772	4512	chrome.exe	110
PID 4512 wrote to memory of 772	4512	chrome.exe	110
PID 4512 wrote to memory of 4344	4512	chrome.exe	111
PID 4512 wrote to memory of 3112	4512	chrome.exe	112
PID 4512 wrote to memory of 4344	4512	chrome.exe	111
PID 4512 wrote to memory of 176	4512	chrome.exe	113
PID 4512 wrote to memory of 176	4512	chrome.exe	113
PID 4512 wrote to memory of 1096	4512	chrome.exe	117
PID 4512 wrote to memory of 932	4512	chrome.exe	118
PID 4512 wrote to memory of 1756	4512	chrome.exe	119
PID 4512 wrote to memory of 4732	4512	chrome.exe	120
PID 4512 wrote to memory of 932	4512	chrome.exe	121
PID 4512 wrote to memory of 932	4512	chrome.exe	121
PID 4512 wrote to memory of 4620	4512	chrome.exe	133

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\pyv2.js
1⤵
PID:2996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb8ce6c728,0x7ffb8ce6c734,0x7ffb8ce6c740
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,9017531704605062056,221002216652815671,262144 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,7705108975102389234,2462930503751961280,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,16858212668765229602,18207813046011028396,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,1847250170002511789,13790063476744109781,2097152 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3468,i,7661439348962351030,8048108160892416703,2097152 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4556,i,431205264572781140,8787596937620518277,2097152 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,4189984254041349334,5291269552495698299,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5752,i,15795605471991474086,18408381364638652858,2097152 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3636,i,5975286923663237297,13476952314344251070,2097152 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,5973317133081854965,17847005645460966808,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,2015331946790285279,1563825687885423340,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5664,i,6005945704354160602,8342973593522079778,2097152 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,11914749609674514487,11465271780102528074,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,1374020099103545782,15621106255335933071,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,9108873630678576940,9636523721437857235,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,5206674205421274061,4437639320901898781,524288 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3548,i,8094746171730977673,15939072208816040786,2097152 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6092,i,2070142952554515715,25520143428709341,262144 --field-trial-handle=1960,i,5425302389739605501,9202387421531139110,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1552

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_pythonv2-main.zip\pythonv2-main\games.js"
1⤵
PID:1856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3fa3abed-9b61-4e9f-b41f-2ca05b43a2f7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3fa3abed-9b61-4e9f-b41f-2ca05b43a2f7.tmp
Size 270KB
SHA256 ac67040320434de97a13b14469c506ddafacefd63d321861642df94dc4972d1a
MD5 8bf2e226dde335abc338aa338bce9702
SHA1 1699f0aa3152a78b9b9e359c39ab6276a60a47b4
SHA512 62f84bbd5d85640b957418c4e32adb55f450f1fd6aee03d588a27b806eab65f702dd6cf6df772b23d08b092f0cc40368d54bdb5e78d216d19d64e0cf9b0d6a4d
SSDEEP 6144:zQNA/ufmDNIg1n9jzRHXOfq0Z+hFD+7t56OD9ZfSAppr+:cNAWfmDNI49jzReSQyFSXD9ZfS4c
TLSH
T155442230B554CEF389F8A141E11737049FB959EF819AA708445E1FC9E3AF88D0AA7137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ca30b34-9447-4fd5-84a9-fae1ac337be4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2ca30b34-9447-4fd5-84a9-fae1ac337be4.tmp
Size 13KB
SHA256 8486e22493cae181cca4139aecee7fcbb876af0119da8ca808df0e349c97d2f7
MD5 e472be60da4cab78c9b84f21f79515c0
SHA1 b4b57e104983d4b5a0eeaeca39cb04f66cbd0d7a
SHA512 c85918513d3e954296f9c8f5cf6e031ad2911e5af092d040b874b98538249f022ccedb6feb343ed2291bb947ab090d55628dc5c1772d6f8fda5705e45e94e096
SSDEEP 192:ZRZcBzAbsA7v73p0PRpm9EKLDl5mKe9vHsb+WNLPf44KpG62bIuPaAOlVyIsnAUp:ZRZmzAwADTMX/hwkd29aRe
TLSH
T1DF52D72ABC6079BB9EDBC229F9127B27E7F5202164A46E84D6FCC92C25E75CC3117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a095d66-da28-4ac2-9484-85ff114ed495.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5a095d66-da28-4ac2-9484-85ff114ed495.tmp
Size 12KB
SHA256 ca48fa0b6db5baaef1c788d6a0d23a43922002ad6f7003cf07f2c2f3223cb82f
MD5 60a4ab33545e8039dfd538185df566ff
SHA1 cebb6071e669dd2a4e828608f0eaa8fe4e0e0c1d
SHA512 ddafffd02e891b4f619bd7b8e0d01e6f870dab93f5e71ab51b3d5f0183f606b32a54f4aeaad95b1d11c1b7393728fca8ae7b30da3ff9971eb634aa53414cd838
SSDEEP 192:ZRZcBzwbsA7v73pAPRp23KCKe9vHsb+WNnf44KpG62bFuPaAOXVyIsnAUgtaJ:ZRZmzwwADbUXmhwwd2kaj8
TLSH
T13442B429BD60757B5DDBC22AFA267717D7FA102264A42E80E6FCC92C24E75CC3127017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70023310-470b-4210-814d-7d7fa6588e07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\70023310-470b-4210-814d-7d7fa6588e07.tmp
Size 13KB
SHA256 1a466a81c54593c37a29b416d5af001bbadb1ceb0eb9b441171901fc399c877d
MD5 5dff0f75399636213397ae2509d47fb7
SHA1 bce1961c6fb2f2f6c9ea95a8d2aab1de8ad090dd
SHA512 5e4970fb12f8916bf550dc6bff52015445d5e8d3f084c8229d20f9b6857f5fdd1321ddf1050a2c4f23d01a34ff7701d97512e916c30600ad59d5adc2daec0315
SSDEEP 192:ZRZcBzAbsA7v73pAPRp29EKLDl5mKe9vHsb+WNLPf44KpG62bZuPaAOfVyIsnAUp:ZRZmzAwADTUXPhwkd2QaPe
TLSH
T14B52C62ABD6079BB9EDBC22AF9127717E7F5102264945E80D6FCC92C25E75CC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ed454d3-bfc9-4ef7-9174-ab1580decf23.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7ed454d3-bfc9-4ef7-9174-ab1580decf23.tmp
Size 414B
SHA256 64c3e47ee9a0033994f325b378a69d0fbda0813445464edc0f2f137dc08cab6a
MD5 76747102ee597a73154368fc0fc3cdbf
SHA1 582741ee17f70f0ba552b78cf88f560ec60b0b48
SHA512 0d734ad63b64f7c9947d182a5b773f5522f15746c754eb4bc2ca06c3923185218dfa0621f2a39e8e4815ed6ba74a99925ca18fc1eb0bba05da2f2fa06e069fda
TLSH
T15EE06195C821ECF705FD475964640346F74913573B81844F3B3C81088FB457BC18981C
MD5 SHA1 SHA512 TLSH

Submit Download

8f4f3861-b824-48ac-8a44-22dc682e8699.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8f4f3861-b824-48ac-8a44-22dc682e8699.tmp
Size 12KB
SHA256 89c03c57fabdd1083c9b0d2990834189a6332f4ae1994ad0b7b38370bb230426
MD5 dad0d73ad9011aacec3f5353b5b2d825
SHA1 77213baedc12debe39e189ef3273f8e78d34bc84
SHA512 af6289428aff1f9dfdabe57a9a5d38978759eecb5a60e3f84a88df2872cebad601d0bd9c9485c9f807b07edb12f47415dc14b5e44b72b618f7a47b50e69cc014
SSDEEP 192:ZRZcBzwbsA7v73pAPRp29EK2EKe9vHsb+WNLPf44KpG62bFuPaAOXVyIsnAUgtaJ:ZRZmzwwADTUX8hwkd2kaj8
TLSH
T12252C52ABD6075BB9EDBC22AF9267717E7F6202164A46E80D6FCC82C24D75DC3117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 eebf1ade56311fdcc2e50e3edb8223dafe91148a0a1b33a339cde102bdfa0857
MD5 fc1d443c69f38e743b98289ec887b515
SHA1 b6c2febd4b274824fb6c9593ceb4698a0fd3d252
SHA512 664ff1fcba88bf129200afd971b08b96cf6936bf9711dc722fdb2b8906740f4ab722060a049d464bf1dcd04aa0a8e3349089b34d5628e7723560aff9a04fc73c
SSDEEP 96:lnYQD1m5fQuZTAsP/mh7AN2f3WxoOXV2R:lXD0yOcHFerQ
TLSH
T117915D6097D68DE7DFA9E838E5C24620B2370E4845270F147D9D247EDB973B0F622C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

202abf83-3c43-483f-8eb8-ce983397d1ab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\202abf83-3c43-483f-8eb8-ce983397d1ab.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

35aa843b-28d6-4e94-9601-51b2cb72a35c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\35aa843b-28d6-4e94-9601-51b2cb72a35c.tmp
Size 8KB
SHA256 1e1e99739f1d708c48e38c6438b3ae0adb9f12951131aa0ad3f3e8d8ee633977
MD5 e2380577379d66e1adc4257f5bd47901
SHA1 c99c1433596745847dd6ac29ec7bf6143bbf3c29
SHA512 b6453226bc08573b4a8049c328380ad762fd39cc85742e40a4f6989456a1d1fbf5e6071199aa45f514b58e31cdfbb3e9aea26bd4c47be989f7bae8d4f93fa313
SSDEEP 192:D8d75hJYBNJCmxNmGaIw5bFNYLhaPHAvvpfP8Ig4WNPrauHmsmmm5ImDme6y6ymA:D8d75hJYBNJCmxNmGaIw5bFNYLhavAXt
TLSH
T1ED029BF7C7E8852D891166F49B15BF1FCF2D0A18431C3C2688E8AE5B93E2971D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 22315c3947ee774474fad5db6edb2ed672ef27b396a7e477629ebfdc4422e4c7
MD5 5927757008543d0e8c650923e3f3a1e4
SHA1 255ed1be49ef9cfad6a6548ad8a1cefed7baea00
SHA512 12dc869dac74812475d54df4576616eac6013172dcb0d9ea20718b75c7f6392a04bbf34e4b5d0fc3caa8f0e3a31c9b54328c9b2c30e8a117c3d3f50eb50ac6a9
TLSH
T11DB0113820800802C8020A3222E200C02B208C2823030CAA08B000A8820228BB302220
MD5 SHA1 SHA512 TLSH

Submit Download

c3d56b8e-163d-4246-b4c0-1b8fde09d5c5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c3d56b8e-163d-4246-b4c0-1b8fde09d5c5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d7958865-f1fc-4930-b67c-580344d53c68.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d7958865-f1fc-4930-b67c-580344d53c68.tmp
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 aa6c362e64e08a3f6412eb51693870e3fb888682122794db54dd1ecd267fc93a
MD5 74e6d5ebb3b3589fa6712bd24f5edbf4
SHA1 0362a64ae924bf6d734b6bd88b1d2604f72e4268
SHA512 aeda0be57d8f9a894f624f4c1904fa71c4f93841ab7f7478f1386deb75e286b1a283977f7140d17a698be39dd70d52b333c3838a4851b71f744aa5f1c5134d0f
SSDEEP 3072:H+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:H+hFD+7t56OD9ZfSApprZ
TLSH
T1B9D31232AA91C8BBC9FC6541B197A300DE666CED51DE3A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbf8a837-4968-4ac8-a4c9-3437c8b1aafe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cbf8a837-4968-4ac8-a4c9-3437c8b1aafe.tmp
Size 270KB
SHA256 b5c93666b51ebe03cbde1058dd43f75e0746f6b0f0e0ff92b0517ab130b3233f
MD5 f3d0046ea451b271bc85272cd9b3039f
SHA1 23ca7263c9874486566540decf58e0402c42686f
SHA512 8771db25286eb435f0a453fc5b863659177795b80b939246d5dc5be1e5ca8c2e5d8fb5d2173a8209238ef365674b3fcfe1d43d2a329a8549f678f5b16bfc7118
SSDEEP 6144:rPNA/ufmDNIg1n9jzRHXOfq0Z+hFD+7t56OD9ZfSAppr+:rPNAWfmDNI49jzReSQyFSXD9ZfS4c
TLSH
T125442331F654CEF786F8A141E51B37049FB949EE829A7704445A1FC9D3AF88D0AA3137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df4650cb-5904-4100-9d28-6082d002b193.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\df4650cb-5904-4100-9d28-6082d002b193.tmp
Size 269KB
SHA256 947ef80c204266deb4e0c4eaacc91703f7411edb5fd5e520cfa173a0111a7c80
MD5 d0f7aee99d6fdc91ec861734e390e60c
SHA1 d9bf83af5df7e638266b1c4703ee35f827a3f9a7
SHA512 3d57759102c7ce9367b12e9f65536e33af52a7448d521cbfcb6711c759629b6dbdcfc62b7ac19f20e072a5574a1d3efa41ebe788ddab716bbc456bcc11741ccc
SSDEEP 6144:9PNA/ufmDNIg1n9jzRHXOfq0Z+hFD+7t56OD9ZfSAppr+:9PNAWfmDNI49jzReSQyFSXD9ZfS4c
TLSH
T16E442331F654CEF786F8A141E51B37049FB949EE829A7704445A1FC9E3AF88D0AA3137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f906b631-3d0e-4c08-8e3e-6d61dd8659bb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f906b631-3d0e-4c08-8e3e-6d61dd8659bb.tmp
Size 270KB
SHA256 c1d0df122fb6e2f3181155cc2efc338179bf1529fdeb5ba8647bc60ce7be2397
MD5 558b8bc633dba59e4ff465826101ea14
SHA1 5b97a114e65d2faf3891a3e46242a1ef97ed3858
SHA512 6df73cc40cba0681df3af278d017c05baf53b5b380ac8badf015d733cc373999cf176158a385e46b7d90dfc3c048fd1eebe08f1f28998c5e7e5562673869d8a9
SSDEEP 6144:kPNA/ufmDNIg1n9jzRHXOfq0Z+hFD+7t56OD9ZfSAppr+:kPNAWfmDNI49jzReSQyFSXD9ZfS4c
TLSH
T1D9442331F654CEF786F8A141E51B37049FB949EE829A7704445A1FC9E3AF88D0AA3137
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95f6d9f5-b766-4440-9242-2ca342815e0e.tmp

Path C:\Users\Admin\Downloads\95f6d9f5-b766-4440-9242-2ca342815e0e.tmp
Size 10KB
SHA256 e3e5ebb977793990b6617bd24784f02eb3b03927cea84ed1c83451a592160f5f
MD5 16cc6fd2fa29a5a2c184dd8c582643e5
SHA1 94a52175e6659f643c1ff5e84050356437750874
SHA512 4c18d918b788d30d5883691c0647d9c89bbc925b3a533b7203671395b046f0d9c4ee7afe4823c74f9b87c1e8a7a11ade23608738d3af9f4a80ab4030e91121fb
SSDEEP 192:YXpz9YI2Rco2gPAqYnOnWRp3vHdhtqNAToeZpWxY1s+qBA80l:q+I2umPnYJPL7wxKz/
TLSH
T1B0227C2EBB54EA1ED7EFC6BD95C45003DE60E03288455A63723A396C9D0B07B60B71AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythonv2-main.zip.crdownload

Path C:\Users\Admin\Downloads\pythonv2-main.zip.crdownload
Size 257KB
SHA256 6ee976dda0c9685c512271ca70750945ed1b5333c02e54db00767ca9e462242c
MD5 fca679016e707e6c32f394c28f2e73e4
SHA1 87af51d957f5e72fe9cba38b3844c9a15e65ed4e
SHA512 d25b1160981591c04606b658b8712b41d0ce6587db57e8c0eaf64df1081740fcfbd683a1b0b835ee73d71467e32f42b16bb92563227448d631b1a2430ca3c52e
SSDEEP 6144:MMqWKtZDuBycYSmYQRCvS02mFwhbWZArWppT:QvzSLr2Gwhnaz
TLSH
T12144E10AE760ED06D7CDA1FE68093542E699E0B0590D8E6326B1356C5C0F67DBE43AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download