hxxps://mosautozaym[.]ru/job/35333/

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mosautozaym.ru/job/35333/
Sample261024-d8ybjseb76

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{20BA0E8A-BB39-4023-A7D0-ADBC211B5DF6}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1876	3920	chrome.exe	85
PID 3920 wrote to memory of 4912	3920	chrome.exe	86
PID 3920 wrote to memory of 4912	3920	chrome.exe	86
PID 3920 wrote to memory of 4952	3920	chrome.exe	87
PID 3920 wrote to memory of 3424	3920	chrome.exe	88
PID 3920 wrote to memory of 3424	3920	chrome.exe	88
PID 3920 wrote to memory of 4208	3920	chrome.exe	90
PID 3920 wrote to memory of 396	3920	chrome.exe	91
PID 3920 wrote to memory of 4208	3920	chrome.exe	90
PID 3920 wrote to memory of 396	3920	chrome.exe	91
PID 3920 wrote to memory of 2212	3920	chrome.exe	92
PID 3920 wrote to memory of 2212	3920	chrome.exe	92
PID 3920 wrote to memory of 116	3920	chrome.exe	93
PID 3920 wrote to memory of 116	3920	chrome.exe	93
PID 3920 wrote to memory of 4760	3920	chrome.exe	94
PID 3920 wrote to memory of 4760	3920	chrome.exe	94
PID 3920 wrote to memory of 3052	3920	chrome.exe	99
PID 3920 wrote to memory of 4792	3920	chrome.exe	105
PID 3920 wrote to memory of 4896	3920	chrome.exe	106
PID 3920 wrote to memory of 1976	3920	chrome.exe	107
PID 3920 wrote to memory of 3336	3920	chrome.exe	109
PID 3920 wrote to memory of 3336	3920	chrome.exe	109
PID 3920 wrote to memory of 4164	3920	chrome.exe	111
PID 3920 wrote to memory of 4508	3920	chrome.exe	110
PID 3920 wrote to memory of 4508	3920	chrome.exe	110
PID 3920 wrote to memory of 4232	3920	chrome.exe	112
PID 3920 wrote to memory of 4232	3920	chrome.exe	112
PID 3920 wrote to memory of 1412	3920	chrome.exe	113
PID 3920 wrote to memory of 1412	3920	chrome.exe	113
PID 3920 wrote to memory of 4780	3920	chrome.exe	114
PID 3920 wrote to memory of 4780	3920	chrome.exe	114
PID 3920 wrote to memory of 4752	3920	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mosautozaym.ru/job/35333/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff5cb6c728,0x7fff5cb6c734,0x7fff5cb6c740
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,22115892395634055,17943446122331347976,262144 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,4047611186357959802,3043544457864129939,524288 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,17804596904154035888,5378792074261474755,524288 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,6686011054293646078,11693061496137135970,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,15233986820655454087,10545370057325634970,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,11005085529245880844,17907798947487553289,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4112,i,4924018817129863774,10809155136042458882,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3188,i,12353159570435180909,7558824350435360785,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,1843384894000160790,1672957701646007693,524288 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,11889681896071481853,10898200229199858304,524288 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,1708470718737976927,17120709628149523379,524288 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,16097175636296801472,9393074304988574222,524288 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4468,i,15964572628530499795,12700861124832701162,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,17477447189566582287,3251393296925958664,524288 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4580,i,5980032452944157239,14573935238541204800,524288 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5872,i,14458609584733067217,7761560223923707826,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5524,i,18344395714451001879,932658441209331956,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3208,i,6987971376139700780,14409672835984197477,2097152 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3008 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5388,i,11202941821550909318,2745085599515903186,262144 --field-trial-handle=2000,i,14078663136534786682,17306015038217498617,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

14a28116-061a-4380-9ea9-1c03dc6e4797.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\14a28116-061a-4380-9ea9-1c03dc6e4797.tmp
Size 131KB
SHA256 f420b78fa773451ac5ef2184b73b3bd868df2bc28f7195410855c30a2e56dd82
MD5 d609137b1ce9c044780c139ce64bf840
SHA1 7e750d49f8bd62bfc62b5ada79b24bcb63faa41c
SHA512 86f9f6b49046d8e63a885beb0b951e9a01cb4520352f73e3c453db77663df9f0018a1bece26d5a9960faba04de01c83326fa05d9b757ed1a99447594b8bfdeb8
SSDEEP 3072:bM+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:bM+hFD+7t56OD9ZfSApprr
TLSH
T1A7D30232AA95D8BBCDFD6541F147A304DD7668ED41DE2A09844A5F8EA09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55f4423e-32fa-4ce2-9ae2-3faf92f23e16.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\55f4423e-32fa-4ce2-9ae2-3faf92f23e16.tmp
Size 14KB
SHA256 a35512c4238456f9e5adb670dd72e4a5125d2e96ee0b260c9dcb8c44b33d23f8
MD5 8f045a18e4708fcca0fb5d4b5f8a2740
SHA1 8bcce8d16d8848bfa91363a37814245b281a6d3f
SHA512 4fb9b5a2318d1a54e41dec5a5ced86058e5e9ec4817a4cc11b529c1bdd3b595fb72bb629ae8f7ac36e9af342671c5c6999ba93ee80bcf3a9c2c172be9207f285
SSDEEP 384:NRXYmh6p4qe2Yjx2XVWw2kK23lv8a8YBE:vYmh6p4R28xSWwb3V+
TLSH
T1BA52A52EE9506D7F8CDBD22AFA16B753E3F5102261942E88E6FD892C11E79DC3217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cd23c17-d584-4e52-9d2a-ffa241a814eb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6cd23c17-d584-4e52-9d2a-ffa241a814eb.tmp
Size 13KB
SHA256 0c27c3b67f6ed14063c8a3e7a1153e89557b57296b4934f46828587cbedfc33b
MD5 20e0fe79bbbfd79a8f498decf627070f
SHA1 a364894562cdbd03c4eff4d8aae5f01b45fa7e43
SHA512 e9b82cf332d97835890d5a0212153966afa5cb50bdd4da5b91172a37ef31037896e4ae943280ff412c8f4eb5f48b05482b6db62e2cac4fe832badb07e9e201ee
SSDEEP 192:NRXw6pcrbqeyPLIv7VNDpAPRp2hVur9QHsb+WNuSor8GG2QyslkwP6fa8BqjVyIy:NRXw6p4qe2UZxUXhWw2k2alv8a8YFe
TLSH
T15752A52DED60697F8CDBD22AFA167753E3F5102161942E88E6FD892C11E79DC3227413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7213f6ef-1ef6-489a-808a-d683463f0fd1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7213f6ef-1ef6-489a-808a-d683463f0fd1.tmp
Size 13KB
SHA256 8c3646402840bb11044dc69268b69321a50106127d048d62ee8a64599d7ef0be
MD5 e81e47b9721d9b782e5d7a9edca380bf
SHA1 e80db4b15dffc202a3d6879e057f36e901311831
SHA512 60a5d683c96475cbbda5ed5222a0b90d02a843bd0bcc9378e94fa3b8c96ccdeafbc7b461c7834c17e694c5ec51988f4903cb442d0c150078dca3b8cb55aaebb7
SSDEEP 192:NRXw6pcrbqeyPLRv7VNDpAPRp2pVur9QHsb+WNuSor8GG+D72+yslkwP6fa8BqTO:NRXw6p4qe2BZxUXlWw2kK24lv8a8Y1E
TLSH
T12C52B52EED50697F8CDBD22AFA16B713E3F5102161942E88E6FD892C11E79DC3227413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7efb0312-34c6-40cf-815b-d20ba93ea05d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7efb0312-34c6-40cf-815b-d20ba93ea05d.tmp
Size 13KB
SHA256 1e272e3bc09e9d3296a3c375e6d39d3636bd3da1668a4862421aecf628e57d0d
MD5 99ee8f597d99bb87ee43dea6dfdd9450
SHA1 d9cdee1823e4ed83846e63aa62cc6dc5f2274fcd
SHA512 9cd24314442fc30e48a75c2a8452654eb84492f3b7d985eafec99f914e8149c989aaa4bb1a0358ea28a6856ea330c0873e54defc69e27a6a4bdc5a1c5e9f4234
SSDEEP 192:NRXw6pcrbqeyPLkv7VNDpAPRp2pVur9QHsb+WNuSor8GG+f321yslkwP6fa8Bqjc:NRXw6p4qe2AZxUXlWw2ki2rlv8a8YFe
TLSH
T12B52A62EED60697F8CDBD22AFA167753E3F5102161942E88E6FD892C11E79DC3227413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 91KB
SHA256 c9cdba467ea80770df0b7e40144345b532ba3d0e1a87fd439a0439620d63ce02
MD5 9ee60c048965422f6b9bbc0ac807d933
SHA1 3cfcfbcf4a58060dcda9756131052c28fa98d0cb
SHA512 10ce86c7c91abe821fd7b7c1ebacafda21498189acf25a37bb94fc4cbaccdfcb4523efcbef8b2a52890111c10dfa6a0cfabcf862540f6e71dea783257035ca46
SSDEEP 1536:GvHmkJt9VsXYCN2hXWECMTZUC/jAnPDLIbdYGRZMDUAn2ihAGmMz15tLtd6:GfjJCYCYpsMNU4APgprZCJ2o/15F+
TLSH
T1A59312F9779AD648C56856853BF8BD2151B84F95FC833F04DEB5881CEA4F26EC881001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 5dbd75ca69b8d6573a8a1960cc57d5d35f7fcb79f8612d54d87bc0145130203d
MD5 60f48625cffce618dcca1fdc65c9e0c1
SHA1 19a4e7059f4ddac9971971a49d7a560a87ae21e8
SHA512 08defd57584b6c7c999926ce92300bead85bcc81dbf1a8f0412e822875a0901b44154ba1ccde9c39991e756e353b8730b5b1aaafc22990108a36a5881a4e4024
TLSH
T1C711538613DA0EC0DBA084B4DBE9C4396AFCD9844BE52ED50885A4B116577B13511E9F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 336B
SHA256 b754b7902a46e00478069c7431077a75b0859e846f824f3891a732c9734fb1f0
MD5 5e5490a8ca7cd7db75aeeed25b744dcb
SHA1 da4de4355c789933ffdd482a7f35cbf0cf5527c3
SHA512 fc6241da60dbc0746881f53f86b2cf9733491eabdcf8d94caaa1e2e8dfdd27df211fa1c126ccb0ad4e9d273d1587ef330390b6d31235efbc314aff2de3f30080
TLSH
T16EE02EDC005C33C6CB20D6F030C6A838BBF49A142F894AE488CC843099BB3300B43FA0
MD5 SHA1 SHA512 TLSH

Submit Download

2c731ea1-16cc-444e-9700-6e7bf2f220d4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2c731ea1-16cc-444e-9700-6e7bf2f220d4.tmp
Size 7KB
SHA256 c026094bcce1fbd8f88de6b8482b539933a62d44f085a643f8284a710d82b0a0
MD5 69941766012ba15ea2cb3291a299386f
SHA1 7961cbcf5d19764e45e25bf8c8ea29bd56ab5f38
SHA512 92c28e872f12fcf83238cf5ed92ca72c0da4322dba025c74ff76d93fe65bdd26e2da04b23f33955399e4c3b510ddc1405e2001f09741c44f4926dbd6bbc20fae
SSDEEP 192:D0atiqs5v8JL3RIaEadfrn658cHIMuScaPGvMfPMuYDhWNP4O1E:D0atiqs5v8JL3RIaEadfrn658cHIMuSW
TLSH
T156F1CDFBC7E8852D895156F4DB15BF1FCE2D0A28031C3C26C9E4AE1B93E2871E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da1d2a37-958e-4787-b666-4cee7d4df822.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\da1d2a37-958e-4787-b666-4cee7d4df822.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 f2de15239236535a52bc654f0798d56524772df3cc2e8765a3554558ade068e8
MD5 e267f430cea017514b18b97f0c9b3df0
SHA1 52c1df883c9b4beb9a7605d1e0d2e4fdbe24ea07
SHA512 f3786c9f07ed07ea44c9ac383dfd5cc8ef793bd5391c091d061a923c75d10dae5b8f9e996b496d4c1bc4620f6ceb0736e4334e1e337a8ee52762705c6fd56cc1
TLSH
T1D0B0129A84415301C41202F815A0288831D8DF19A606135191F00D239C36160811B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 3d963e9d2fe2b42b757005afbadbd0158eae5839ab150817aace4bd18c0fb05d
MD5 1c4179b735ba4bc1faaa26e2bf918e5a
SHA1 49fb8e3b4730dff3210d216eb4dbf923d936497c
SHA512 75310138fbe7397868e5b310e4b119d07cfc53491efdb571b358492594847e8e37921d2a76e23ee6dd2974acd7fb0142f6c2b809b72e5844aef9ca668449d4d2
TLSH
T1EBB022F8C00F3222C00203B228C082C8B2A0CF2AC2C3222382F02A32EC20320002C820
MD5 SHA1 SHA512 TLSH

Submit Download

0d49389fb5fd2bdc_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\0d49389fb5fd2bdc_0
Size 196KB
SHA256 abb17aba0a7312dd50ec5976f1c24e32c84160993298b57b833bd0a819495c81
MD5 a544d63ff9ca5435c2de93456c88c819
SHA1 c11e174e60d7c65e8724d653d408e29ae541f8fe
SHA512 921c05e309fae17a10c5c0f9ccd093222298bd871a1f9eba413f7b93b892e20e754334413cf98885f1bec775b0e7d6e75d6ac91738f849c0078e0518b90346f6
SSDEEP 3072:p2XU0LBARbIRdaYcob5ISvXFjvyomKJZu:8XxLBKIRdaYxdImNNJZ
TLSH
T1A9146B356300F43FB923DE6162BE7F4E3C25A167DD0686FCA5A4E9309AD2DF20522748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 6b23ed15c04dce7f1457390a7d920711dfcc162ba3ed11144c5ed1749b6b8089
MD5 f9e899cfbec7bdf2f53c3008dedfcd14
SHA1 a28c74f064d2d0714b0f8f3231b9668258552d9f
SHA512 1436f3ae06428d692c78f0c873931a0e10a3bcccd44c4ae9b186d5dc2f081d473dd447f64169dc4de4acef6221539d48d9bde687e42403ca67b2bdd4411ff8ea
TLSH
T1DEB022080282AA03CE0233BA3EE20CF033320C20038BCB3320F808308023380030C302
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 98156d78f442a150a262b7c485f61a6ced7f0c6ddc0365079df39c7607bebc55
MD5 1669e18aa634150a26a10c17d0c538e3
SHA1 4a2624dcb5529b587715ca8c6221bb3e994c7adf
SHA512 ac0433557fa2cb1454e07200bd4ab0e3897dabf405897939bd1f8b707bbecf4483d1913726cc242b1563abefb14af9419175119013770273d1c78991c9fee974
TLSH
T13AA0025112DA4C11CD0273B718E106C323A19A340312C25354A7515489772E0524E092
MD5 SHA1 SHA512 TLSH

Submit Download

aab8f1ae-1fbc-4ff8-b3ff-94037f3d9f90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\aab8f1ae-1fbc-4ff8-b3ff-94037f3d9f90.tmp
Size 14KB
SHA256 b494e61f07372ec9c7e51cecb31e35f7b1764c9454464712d269b67764c84218
MD5 779b83eba2269d00b677242dea1e1e0d
SHA1 4c0eeebf4312622db708a61e247a5a2a742d6b5e
SHA512 a0dafae9dea8b578fc1e281968512282b6ec5965118828fb163155216d9e94f3cdfc5a61b7a4f5636d6bb5bcc89c2c71d8f6810856f0ed434ef44469c50837c0
SSDEEP 384:LljHG7KxkXqKf/pUZNCgVLH2Hfgsl++7pLuLceShMXODHC+ErU3Htb5w9:L1HG7KxkXqKf/pUZNCgVLH2Hfgsc+7pY
TLSH
T1E562F867AC4C9E3B0FD4D649CC177A4FEDB4025621AE886482FB982503E4BCE110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beef8468-f389-409b-a287-f53ef29750ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\beef8468-f389-409b-a287-f53ef29750ba.tmp
Size 13KB
SHA256 cac6c877d97644a8a95fc073ff4f13e1c51b68ae2b551813d3e01b25d9458380
MD5 f3cbeba9d1642e7fdaf20517cfa5e071
SHA1 e1e5490aad8435a425ca016fceece876436f4176
SHA512 6e0c265c4e496717f04389489dcffc295890fc4e4e0195ea3a6130fee106e129a4993f6b5cbd71927fe441c543e306ac0914bf69f06f4c4e69d482e2dd56758f
SSDEEP 384:NRXYmh6p4qe2PjxUXHWw2kK24lv8a8Y1E:vYmh6p4R27x+Wwb4VS
TLSH
T1BA52A52EE9506D7F8CDBD22AFA16B753E3F5102261942E88E6FD892C11E79DC3217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d05604de-b2c2-4bd2-9e00-eb32895b98e2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d05604de-b2c2-4bd2-9e00-eb32895b98e2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d06935be-fdde-45ed-bde7-73388c756377.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d06935be-fdde-45ed-bde7-73388c756377.tmp
Size 414B
SHA256 3e9d41562d93cdbefaa5721fa40a025a854917f3a020a5ba074c423bddea8f24
MD5 af45a84631f635c962a2b4c05f9ca23c
SHA1 8e8bf55bfd483d507ae35b3db28ca7b9f2b9dc4e
SHA512 8d4990f2ad34691b56a2790713303fa2aa28347213df930e5ab06f7fd6404168436f6aff6c468a1af2c65a3805de79c188db2aab6464b3100f7b15608f915104
TLSH
T19CE02BD9D862EC3709FD0B5C65254646E75113573641490B3B3DC5098FB0636418685C
MD5 SHA1 SHA512 TLSH

Submit Download

b5d52750-df76-4401-88ee-5df515d4a6ac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b5d52750-df76-4401-88ee-5df515d4a6ac.tmp
Size 131KB
SHA256 4b939c76fff6f1910d5d69f9e08bccbb48156f2a5611c647d3136bad9bf6d3ab
MD5 8e236a070111796e75a8ae5cef0c2596
SHA1 9806c571433b48a4e0d8fd508492f3a803f87b94
SHA512 77f69dbee81792836147176b0ddb9f75155c052b386a750c70636c6791b09e592fdd9b59ba466f5ca1825c8a776711c700906b9d1af83b986be4b86e0f816cde
SSDEEP 3072:bp+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:bp+hFD+7t56OD9ZfSApprr
TLSH
T1E3D31232AA95D8BBC9BD6441F157A300CD76A8ED41DE7A0984465F8EE09FD4C03B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce6510f5-88ad-47ce-b5b2-d04df2d3a332.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ce6510f5-88ad-47ce-b5b2-d04df2d3a332.tmp
Size 130KB
SHA256 b885f495addd858dc80c3244436a21bbe6e9eb710b0d4229ffdd1a95098a75b3
MD5 c031d227a208130bb178c0442f6975ff
SHA1 d607fad78a5ec9d29e8ce2a9b53834f7f35a98e5
SHA512 e400df7a3849b288904c000b8f44fbbec3fde3d3b662ad88ff4dfeb6a502d278a280e1f09d5b07324c5b8c77331b97e0c908e2297b083a29172d4de7c8ede12b
SSDEEP 3072:p+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:p+hFD+7t56OD9ZfSApprr
TLSH
T1CDD31232AA95D9BBC9BC6541B157A300DD76ACED41DE3A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df6fa4fb-0e9e-42a8-bcd0-48d40096841a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\df6fa4fb-0e9e-42a8-bcd0-48d40096841a.tmp
Size 131KB
SHA256 4caadf5252c9aa012d470a6f6d61d33399b15e579cf9fd77f3e448f32469a54f
MD5 6f5254cbb4612864c8c395eab17734f3
SHA1 065e94a831f1f825e19dd058ba6475fbda3c7e11
SHA512 7c636c441f58a55acc08d2dbf06f85a264be0bfde74164f987016dd66a91ce702b08779097d11237b0962e007920c591cece6c9bcc246a9f0a893143f15849a6
SSDEEP 3072:Op+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:Op+hFD+7t56OD9ZfSApprr
TLSH
T185D30232AA95D8BB89BD6541F157A300CD7668ED41DE7A0984465F8EE09FD4C03B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download