c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e

Analysis

user interaction
yes
max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/10/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/SysRestore.dll
Size 5KB
Sample261025-rc5yeahw8l
SHA256 c686b4df9b4db50fc1ddb7be4cd50d4b1d75894288f4dc50571b79937d7c0d7e
MD5 4310bd09fc2300b106f0437b6e995330
SHA1 c6790a68e410d4a619b9b59e7540b702a98ad661
SHA512 49e286ccd285871db74867810c9cf243e3c1522ce7b4c0d1d01bafe72552692234cf4b4d787b900e9c041b8a2c12f193b36a6a35c64ffd5deef0e1be9958b1f7
SSDEEP 48:S5SLAPmT5fqaB2WB2BtBAQPcPzRcCB0E3ngT2p2UlE41qSK1Gx:ASQM57LAfuQULRxB0E3gKU941LKQx
TLSH
T125B12277D7D089B2D182073A44C749E72666D165239045EF456BAC3A39622E7EC3C7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3684	780	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{477B129D-8D43-43C4-AEC3-F2310FD5F50A}	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe
988	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 780	2964	rundll32.exe	85
PID 988 wrote to memory of 3308	988	chrome.exe	100
PID 988 wrote to memory of 3780	988	chrome.exe	101
PID 988 wrote to memory of 3780	988	chrome.exe	101
PID 988 wrote to memory of 1404	988	chrome.exe	102
PID 988 wrote to memory of 2200	988	chrome.exe	103
PID 988 wrote to memory of 2200	988	chrome.exe	103
PID 988 wrote to memory of 376	988	chrome.exe	105
PID 988 wrote to memory of 4900	988	chrome.exe	106
PID 988 wrote to memory of 376	988	chrome.exe	105
PID 988 wrote to memory of 4900	988	chrome.exe	106
PID 988 wrote to memory of 3668	988	chrome.exe	107
PID 988 wrote to memory of 3668	988	chrome.exe	107
PID 988 wrote to memory of 4224	988	chrome.exe	108
PID 988 wrote to memory of 4224	988	chrome.exe	108
PID 988 wrote to memory of 2460	988	chrome.exe	109
PID 988 wrote to memory of 2072	988	chrome.exe	112
PID 988 wrote to memory of 2072	988	chrome.exe	112
PID 988 wrote to memory of 4760	988	chrome.exe	113
PID 988 wrote to memory of 4760	988	chrome.exe	113
PID 988 wrote to memory of 3276	988	chrome.exe	114
PID 988 wrote to memory of 1744	988	chrome.exe	115
PID 988 wrote to memory of 3276	988	chrome.exe	114
PID 988 wrote to memory of 2428	988	chrome.exe	116
PID 988 wrote to memory of 3408	988	chrome.exe	117
PID 988 wrote to memory of 4752	988	chrome.exe	118
PID 988 wrote to memory of 4028	988	chrome.exe	119
PID 988 wrote to memory of 4028	988	chrome.exe	119
PID 988 wrote to memory of 4140	988	chrome.exe	120
PID 988 wrote to memory of 4140	988	chrome.exe	120
PID 988 wrote to memory of 2080	988	chrome.exe	121
PID 988 wrote to memory of 2080	988	chrome.exe	121
PID 988 wrote to memory of 4204	988	chrome.exe	122
PID 988 wrote to memory of 4204	988	chrome.exe	122

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SysRestore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SysRestore.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 600
    3⤵
    - Program crash
    PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 780 -ip 780
1⤵
PID:3828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffea248c728,0x7ffea248c734,0x7ffea248c740
  2⤵
  PID:3308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,4346001384404154534,1226061763624797533,262144 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,3360236315932333204,602300572712264963,524288 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,8012440807386754126,3739951949048272763,524288 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,8915074017813316181,5252588264074346072,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,183908076824551354,16171648278624623977,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4388,i,15319893518650805844,9980795552845688113,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4392 /prefetch:2
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4804,i,4460893378753359287,2502306766071623918,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,9167243033098491563,5698371697311837712,524288 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5820,i,12641380189821203628,16802635432149768537,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5924,i,13227308381292042605,7889242560469006917,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,10825523532213846810,2241347987425364901,524288 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,5202383282805022120,12219382411105069386,524288 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,18334330813347763721,10666161608624262468,524288 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,14470436237412213783,1528674357385254415,524288 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3272,i,7881457383413725020,330907511450598926,524288 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4416,i,16315727984948747876,15139518615480292661,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=244,i,5443802967870317380,5571278178364875109,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3220,i,783712720543611031,3930373594230867292,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3200,i,13082314281482628255,17430583138291830305,2097152 --field-trial-handle=2028,i,9187155673235820777,15292019931607613070,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6b620240-ca22-487c-a3ae-c1a2ed12ae9b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6b620240-ca22-487c-a3ae-c1a2ed12ae9b.tmp
Size 130KB
SHA256 4b3598894918bc30b89459a72df31e1161a3300a5bdaa5d0dbb53aa2a939e6af
MD5 4174b163dc7a657ec0cf3520b9028566
SHA1 5be4cca2d729c5bd6d96dda0fec9f8aefeca4621
SHA512 c2d6647c5d281f5ca65a703613e4ff52c278ba5a815178656bc10583b71389c0cf6c9fe7f788ea47a4a03fc34712366d55836ae197c43ed1bbfb3cf50fe2fa83
SSDEEP 3072:M+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:M+hFD+7t56OD9ZfSAppry
TLSH
T15DD31232AA51D8BBC9BC6541B157A304DE666CED41EE7A09444A5FCEE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a86581e-80f9-48e8-9807-e784a13d7ca8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7a86581e-80f9-48e8-9807-e784a13d7ca8.tmp
Size 270KB
SHA256 5be3469c28275e6bb452b11f7e33d488b0b3663cf6ddc653c093f2a8d698c6e4
MD5 f6bb154996347ce1ac5895789bf3e968
SHA1 abded5e592fdbef7d812055453e39adc14c9ffb9
SHA512 fb97463a1bc2ba67aeb9b2b11414dfaed0673529536de7b68847b9f6fcf00f3492dc728055eb7cb65dbae0fc1985c589c43b24b1adaa3733bd321a647c5ec0bf
SSDEEP 6144:UBZiJiUlROfnFGCKUGFsqaB2yI+hFD+7t56OD9ZfSAppr82:nJiUlR+ngCKUGKwyFSXD9ZfS4+2
TLSH
T1004422276E948857CE7CA450A2773215CEF2ACDFE4C8658D858F1FCBD09FD690762822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c9baff7-905d-4a01-a2c2-0a5411321a49.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0c9baff7-905d-4a01-a2c2-0a5411321a49.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

0f284f82-b378-431d-b3c5-a6ee258c7c7c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0f284f82-b378-431d-b3c5-a6ee258c7c7c.tmp
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45339973-9aed-4e21-bfcc-b946a2a9fbf8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\45339973-9aed-4e21-bfcc-b946a2a9fbf8.tmp
Size 414B
SHA256 c1f41fc705a1ef73c1793820508ead4048d366ac0a8b3a04294380fd074385a0
MD5 ae84f58dc79c6f490b0b9ea672d8ea7c
SHA1 71d9ddb7d5bbf2b0ddd4c4e853239063f97347c2
SHA512 f9f80e5fe4822ba264c7116b56daa64532935eed200a79e10f37edc76542ac8b7c283a46d2d72b80276c8edbdb94d9b0a26467e659e4e1788da112ad4d89d9b8
TLSH
T114E02BE9C921FC3714FD1B2951541745E74003577A406A4F3A3D911D8FF063B858685C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 984B
SHA256 8e01cf3fdb000a05bbc0edb3cb44c668bfa2a5d55a87236e1cd94da1c0c221b0
MD5 7782546b36f2beab9599bf1439104bd3
SHA1 5d8ef10f19aa2cd93f7f225ba02e88b145355fb6
SHA512 becbd593e003851872a6ee63f86c116d17aecfd77612deba18aaff6ca62294fd5b2b0502a8ed4c5b38b12a5d1bd876bf0f2f2ab0484539cd228de93ce524d3a8
TLSH
T10211689261611256DFF84FF63BD344BC77011099C015354E3F60E4B535E32B0FC42888
MD5 SHA1 SHA512 TLSH

Submit Download

7f91d2dc-9259-45cd-95e1-bb7c06d44a12.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7f91d2dc-9259-45cd-95e1-bb7c06d44a12.tmp
Size 6KB
SHA256 51beaf217bd925ee5499dae174c82faa78882bbab89bedd18bab5eb7c8993100
MD5 b3b54bd31aaf9c423e7f8aef05eb7f23
SHA1 7797c404bee2953f7b0dc99b2819f66278428b03
SHA512 3d632ac3fe92e7710173fc67c44bd5ac1f684dc3c0eb654f2155c1553dcd04d58af58aff6fdb4d3420081158a525fc6a828f27da40c308192c44381f2a8333a1
SSDEEP 192:DP9peXFsJQJ9aabd5UiivsZkI3xaPMWvgfPHNPL1DK:DP9peXFsJQJ9aabd5UiivsZkI3xaEWYS
TLSH
T123E1AFF7C3D8862D891156F8AB156F1FCE291A18432D3C27C8D5EE0B93F2872D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a529b3ae-8ea0-40b6-9fff-ffdda2e00a79.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a529b3ae-8ea0-40b6-9fff-ffdda2e00a79.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 d2645e0763020dc501cb0f65b7ad026d8f1cb024df10e60fd3f04214c54c9595
MD5 6fabc9a6d2e50d63af4eb9f85e80343e
SHA1 f406acee7011dfcce81fa219f1b95b335fb8ebda
SHA512 c32de5f620f9a674f82d64412bee59a380b0eeb06edf9a3b243b32dfcdebc68af089737026e1aed3eb15c577c863ed9ddd46d29cf5d8caa21fd6cda9dd4f82e3
TLSH
T120B0120580416713C04103F02551A09433B09F35D112138682E00D61883115453B7208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 905d724a79f1eb0e0bf8e50a7001db74e51706d1ec3c333e9f4de390521f229f
MD5 8a51cd558b2bfc0ff57777d69770ca2b
SHA1 c3c9825431481b3c6596b7aa70e898216ac05743
SHA512 321eaa6ba86f4d6ca46edd18eb89f78677b3f399ed6350e89f4a9829777833a8ed7549a55faca7fce7044c6eec5c1b4518b7dc89aab22b9f24b13f9e4724fba6
TLSH
T198B02232C0033302C00303F038A0A0CC3020CF28EA0F022282E00A32CC222B008A0830
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 e3e5bbb213d609b371ecffa1389ad2e095b1f3db7229cb4f1121d49d61aa57fe
MD5 b25dfe0620bb9812043b3f981568e5ed
SHA1 f8b872a9421fc74ed97b44b556c2776a6c153622
SHA512 0c486e01b954c525a60ec2a2f294cd0eb3d4ecb5c178a8a039618441e09e139fc26f2c00f4311cf555a05b72e7cfbf45e284b4b7ab8c5253e3b7452bbfba3431
TLSH
T10AB0222800202A02CA00BBB2BAC88BCC33282FE0EB230E0280BC20A888023C3C303300
MD5 SHA1 SHA512 TLSH

Submit Download

c9cf012f-daf6-411c-b662-9126511ccc69.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c9cf012f-daf6-411c-b662-9126511ccc69.tmp
Size 12KB
SHA256 ce64395d5d134d798b9abfedaa029c8ea21bfd438af6dfb277dd2cd014710bce
MD5 4e93814d370fe252d471df74c5480290
SHA1 975ca66e97f2f46e0dc79a4026a7cf9f5c1126cb
SHA512 527eccca6ff8ab60efdc175b44e8a817abe1d34ab12b8e9a6997ce3ed79d58ede0a1d7bb31de6dbcea254bf55f46d8c5b3d00377b341d52e952bc74436213d10
SSDEEP 192:XRKE5KlR1dFq+z+v7D0spAPRp239+Hsb+WNn0L0lLW9UoQimxGEVyIsnAUgtaJ:XRKE5q1djz6vjUXoUwU0FW9bQrAA8
TLSH
T18F42C52DB910797F5CE7D22AF9227B13D7F6102520942E84E6FC8A3C24E79DC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cda8c001-34cc-4b9b-bfff-b6b25fc8dc24.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cda8c001-34cc-4b9b-bfff-b6b25fc8dc24.tmp
Size 13KB
SHA256 455f6b8da087def1c3f2c43cd76815d52f9e373b905cd82790d1678d9e1bae65
MD5 6ab04d8856db4a0d3e9dd99dc3e009df
SHA1 ae7ed0d83755f9e2c5f09c522e84099f31122216
SHA512 db005414cac65bacd462341a9179d27a62e45716ef381be2b271ddb5024732f8ee5bb3880fa6eab04da80bd12f8f16db081facafa58f720265d0e968f3be3762
SSDEEP 384:XRKUmz5q1djz/NpjmXiUw0IetW9bQrAae:sUmz5A9Xj9UwOI
TLSH
T12652D52AB810797F5CE7D22AF9227B27D3F2102560942E84E6FD8A3C24E79DD6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed0c0fb8-6e4c-4bf4-976a-4e0f699b98cd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ed0c0fb8-6e4c-4bf4-976a-4e0f699b98cd.tmp
Size 13KB
SHA256 3d855fde990ddb6142bef80e1b8209e3fa44ad7ec78e2ec7a6796bfcef566aed
MD5 c08eb164a648bf4564fc171d788a0e04
SHA1 8871bb1c9e03188f8e85701f3864f9d150024daa
SHA512 78cbaea206ffc14c90f4666419471a88feda2a439ef57b9fd05bf4625036c6195e2d5ece72290c690069c46a1aeace9e852101a7de73fca51076cf2b070fe3bf
SSDEEP 384:XRKUmz5q1djz6NpjUX8Uw0w2xW9bQrAA8:sUmz5A9Uj/Uwe2
TLSH
T17B52E52DB910793F5CEBD22AF9227B27D7F2102560842D84E6FD8A3C24E79DD6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8fe4d61-5dd4-4636-b0ef-5987ca47082f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e8fe4d61-5dd4-4636-b0ef-5987ca47082f.tmp
Size 269KB
SHA256 735f6004cc3d796a0526b2fe6be4793a279ec702ecebfed820a6316cfd3ccaac
MD5 be2074d9ba377c7817846cce1c333992
SHA1 94ba9fe8d9275566b6d9264153321a2f80aa6853
SHA512 a3a8e32df1068128b158dc276d80004f4d51a443a9cf3f4a87f29e156d30707002b6978982399266df55f31b68fdea9ba4d5996d3445737b03e81b46edc39d5e
SSDEEP 6144:rZiJiUlROfnFGCKUGFsqaB2yI+hFD+7t56OD9ZfSAppr82:EJiUlR+ngCKUGKwyFSXD9ZfS4+2
TLSH
T1134423176E958857CE7CB050B2772315DEB1ACDEE4C82589868F4FCBD09ED6D03A2823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download