hxxp://cdn[.]vdey[.]in/DYEdx5Z

Analysis

geolocation tags

brbrazilsouth-america
user interaction
yes
max time kernel
269s
max time network
263s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cdn.vdey.in/DYEdx5Z
Sample261027-cfyaeacd94

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1768	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
3412	chrome.exe
3412	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe
Token: SeShutdownPrivilege	2416	chrome.exe
Token: SeCreatePagefilePrivilege	2416	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe
2416	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2216	2416	chrome.exe	86
PID 2416 wrote to memory of 548	2416	chrome.exe	87
PID 2416 wrote to memory of 548	2416	chrome.exe	87
PID 2416 wrote to memory of 1768	2416	chrome.exe	88
PID 2416 wrote to memory of 3884	2416	chrome.exe	89
PID 2416 wrote to memory of 3884	2416	chrome.exe	89
PID 2416 wrote to memory of 5096	2416	chrome.exe	90
PID 2416 wrote to memory of 2812	2416	chrome.exe	91
PID 2416 wrote to memory of 5096	2416	chrome.exe	90
PID 2416 wrote to memory of 2812	2416	chrome.exe	91
PID 2416 wrote to memory of 4236	2416	chrome.exe	93
PID 2416 wrote to memory of 4236	2416	chrome.exe	93
PID 2416 wrote to memory of 3760	2416	chrome.exe	94
PID 2416 wrote to memory of 3760	2416	chrome.exe	94
PID 2416 wrote to memory of 2716	2416	chrome.exe	95
PID 2416 wrote to memory of 2716	2416	chrome.exe	95
PID 2416 wrote to memory of 4136	2416	chrome.exe	96
PID 2416 wrote to memory of 4340	2416	chrome.exe	105
PID 2416 wrote to memory of 4340	2416	chrome.exe	105
PID 2416 wrote to memory of 700	2416	chrome.exe	107
PID 2416 wrote to memory of 2296	2416	chrome.exe	108
PID 2416 wrote to memory of 4604	2416	chrome.exe	109
PID 2416 wrote to memory of 3060	2416	chrome.exe	111
PID 2416 wrote to memory of 3060	2416	chrome.exe	111
PID 2416 wrote to memory of 3412	2416	chrome.exe	112
PID 2416 wrote to memory of 700	2416	chrome.exe	113
PID 2416 wrote to memory of 700	2416	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cdn.vdey.in/DYEdx5Z
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd9047c728,0x7ffd9047c734,0x7ffd9047c740
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,16887641123304926461,3629094339297051658,262144 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,11164181394607763060,13594086093637849292,524288 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,4347761267604680427,13251553674095388781,524288 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,3906872595883190949,5495245998563938898,2097152 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,5396304183245823091,16496838849317951432,2097152 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4400,i,10617900078105672513,6390939227476755995,2097152 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5096,i,492079493664657109,9531732818064031927,2097152 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3908,i,6310012393248143345,15328491458797524472,2097152 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,14156271608618046986,4910149003877381154,524288 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5148,i,2759798929940653084,8131742331399239687,2097152 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,6728312561362291526,4727936280531969770,524288 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3076,i,609389364070780505,7451216056719635684,524288 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3204,i,462021712892337295,12747736914413260397,524288 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6104,i,6604055454830708408,7860748788331101525,2097152 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3496,i,13556109763736006632,14967392032726236490,262144 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1136,i,15966260697003251049,13760334070062350304,524288 --field-trial-handle=2016,i,8782180399188417146,5578334558250269990,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26b7a6e3-dc50-42e5-9326-a2251c679775.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\26b7a6e3-dc50-42e5-9326-a2251c679775.tmp
Size 130KB
SHA256 664499baa2341289de323dbccbf4eabbd03f08121356ff11c9229b0164eb6460
MD5 b7a521269cae12afca4d91a732108a04
SHA1 7a95379daeef7c7d0351235e14ea87f9d29b7d08
SHA512 2dbe074193eae4052de225cf36af4c38b6434f86193d76ec6bea716c34e8abcb9d408f274ae62e80e9160d3e68a8ed63ff350bdc89116033ffe5ebbdd4b6a05e
SSDEEP 3072:wJo+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:w2+hFD+7t56OD9ZfSAppr3
TLSH
T10DD31233AA94D8BBC9BD6541F157A300DE626CED41DE7A09444A9F8EE09FC5C0673A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41a0232a-7c54-467f-bafb-87b4e1d11c71.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\41a0232a-7c54-467f-bafb-87b4e1d11c71.tmp
Size 131KB
SHA256 e5f17985514a23eef31db117339d0d32a32193e73df36634b2039373f8e70348
MD5 42d0500791c6063cf9ae78f7b8101f70
SHA1 f7ea4da002b5c78785ab84cd5fd93d6caa40f103
SHA512 6ae0501ae05f4c53ea7e9ee8f2ac9c74eeaac0f743f64d066ad16d0d24235b3afe04f281c0d5323fdb0989aecbb4caccb3f1991b8bfccc0f86d8799c46644886
SSDEEP 3072:2Jv+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:2d+hFD+7t56OD9ZfSAppr3
TLSH
T14FD302326A94D8B7C9FD6541F157A300DE6268ED45DE3A09844A9F8EE19FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f47f579-4a7a-466e-90f2-34814331121f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0f47f579-4a7a-466e-90f2-34814331121f.tmp
Size 13KB
SHA256 a23f24a115867508ab46baece8fee88ac4e35a7b5a56fe110c72f6c168e79549
MD5 6d6d63c5bbaced11a22d37d06ebaad7d
SHA1 d49bcfdada30d5f322653902e1a7be3c7a69c982
SHA512 aade5e754d986261d0f6ddade25e6fd7b81dba4cd8445e0063b3a592a05ba38469097bd58f6194302bf0034e09dae9f8db3c2cf6008583f70d1bd6d3ab824e2f
SSDEEP 192:4RjjFzE7WUNv7VJpmPRpIF8HV59fHXS8b+WNTEd5+lKecxkQdzzKVyIsnAUgE:4Rj5utviX75hXJEJecmQdCE
TLSH
T11052932EA910397BADDBD32AF951B763E7F5202225911E84EAFCC93C15E76CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2346b837-17fc-41c8-9d55-21993da0674e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2346b837-17fc-41c8-9d55-21993da0674e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4b793368-cc76-47c0-84a0-dfe17f723d9f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4b793368-cc76-47c0-84a0-dfe17f723d9f.tmp
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9af85695-d67c-4d57-ba2d-d682c723eb99.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9af85695-d67c-4d57-ba2d-d682c723eb99.tmp
Size 13KB
SHA256 4c1304949c17d8e0784b67c03fdbb44f07ebbb015c006dde2d587413b6d3fcb5
MD5 1780eb4ca0a3e09a39c5dcc46f84e77b
SHA1 62aff67412afec3cfd522f199340dd317897c81b
SHA512 abca2d0e75945307ff354e1106b9932d209726d64be4ddf9f5df86525dc2ee8470120c6e07e8b1cfc607d19182e12a86d3b9f2d3a708e66841c2ddea6c26f916
SSDEEP 192:4RjjFzE7WUAv7VJpAPRp2F8HV59fHXS8b+WNTEd5+lKecEkQdzz2VyIsnAUgE:4Rj5ucvUXJ5hXJEJecNQd2E
TLSH
T1F852932EA910397BADDBD32AF951B763E7F5102225911E84EAFCC93C15E76CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e178c3b-47cf-43f1-ac1e-9d4fdacfe82d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9e178c3b-47cf-43f1-ac1e-9d4fdacfe82d.tmp
Size 414B
SHA256 3a9a168ed4e900bb493808ddfe2fc31e9ef851849b30291cb6540e40a8eca45b
MD5 f599f59441d341a91f1b0cbfa08ce995
SHA1 1e06bd1f65b4a5de7949403c2d0760ca6483b32a
SHA512 4f266cf3d69d636765396be265624102f78642e43b409f407f04dc94c9b6e0506c4b783f1c2bc2666526f96d33bf8c645766c5be5685d2ea5f13126ed2547ba5
TLSH
T142E02BEACD30BC3B1CFC0B2950A0474AE76123A72652890B7B3C910C8FB467B428695C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 120B
SHA256 4e2b72b07172696b90bf086afec75eeb3413f0872fb59b2b5526f5537a2fe838
MD5 6cfbedf0df941e84b5850a64107d4202
SHA1 a2650834b22273a7080fa92714a03b072e64b143
SHA512 a62268400898ee177c44bd6faf13c4b0dfc8dc7b6101a37f8ca4a67d360086e0ae2cd7a6614684732e4a9b56432d1ab7e640c79f8a263f99b0d00e083b1f38b7
TLSH
T112B0128415C1C816FB1086F81431009432517C5A95164717D2D57C7544372D5F2072C7
MD5 SHA1 SHA512 TLSH

Submit Download

07f2fd0a-0d97-4483-b36f-162d7be1813d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\07f2fd0a-0d97-4483-b36f-162d7be1813d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

22253dd6-6013-4545-9b30-b792ec2e51e7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\22253dd6-6013-4545-9b30-b792ec2e51e7.tmp
Size 3KB
SHA256 f9354c00943c4eaba4ff0d930992bd38d070ddea6294acb7ab69dec8aeb3a095
MD5 9a1207eb3944d6ea4eac3962c1b8aa15
SHA1 9760eab92253f2578714340a2d2841554aafe090
SHA512 e7d5838849d2c73ee58dfd05cc946975a10546a1fec3e46f40c7dcfa5afd69e1ae0caa1f99404dee05d88b76e75a02a161ef520aa9c49e8733dd0d0ff620b90a
TLSH
T1AA518EF7C3F8866E892196F4EB142E1FCE690525031C3DA689E8AF5B53F2971D14074E
MD5 SHA1 SHA512 TLSH

Submit Download

8d0d1f6e-afac-4647-bc5d-fd820f5f5dce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8d0d1f6e-afac-4647-bc5d-fd820f5f5dce.tmp
Size 2KB
SHA256 170fa422f36effec249e0b91dc4bc56ad42ba92be2c2d2c4a686285aff6074ae
MD5 535e9f7465a90a5541dcfb5e7a9e1510
SHA1 c38d223ad33ff647851fb5321ac4640f09494721
SHA512 19789b549d5fa7edba47c0a8bae4fc02eecc4b841e52a5f2f2f7e67f5c535d475ae33e525d9d16c446ce726b28e0a9d435ab6adee0ad1edbef8418898526dbe4
TLSH
T142417BB3C7D88A3DC901A6F4AB152E2ACE7A0A14632C3C56C8D4AE1F53E28F1D35055E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 27dce4843bd530131292f3e05bd7d9e34c692f46bb1dd79050a2e3b7d78d545c
MD5 881b63668c81c66557fcfbcc24077c14
SHA1 50ce461195c1a9a5fc77b2bdc99b7d8dcaa8a60d
SHA512 75dd27b78acc2f00e805855f9d290b0a11987af7a04d617d6206fb6c7eae3549ff86a46b8c22649a8de86e071f335d6433c741f89a5ea65116bb823edf87ab22
TLSH
T1ACB012458041A301C01202F8116028D83554DF10B605130552F01D159C35250922F0D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 2b4c810b8e71ecfb55803bb74808e3e4322af4bfdbcec269f61d6ddfae7b4d36
MD5 0c93573331d7605b0c558a05bf9d4ef6
SHA1 a6d6e1f2731dacc1c1a49848da2582ee183eaf33
SHA512 c65357c5f0e90f89acdb05e12a5e80482341b6446bb7a1a0fc40eb06cfe110afb9ba09495250f18803b65b2de3a200625e2d12b02a730c98801aecf4c97aa666
TLSH
T1C6B00255C102621AC55203F82DAAB9D87668DF35D703131AD2F03A76EDA5660A625560
MD5 SHA1 SHA512 TLSH

Submit Download

a1d82bf3-a365-49f8-b051-f87a614e7b24.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1d82bf3-a365-49f8-b051-f87a614e7b24.tmp
Size 12KB
SHA256 aa7f1ec38ee5349fc767559d120749ec74f61f92561b29d9bf0d1341118cc977
MD5 c4753f212c133c7815cd53d99f4c0b6b
SHA1 6b4e2cfa813651e10b8016495c676201280e523b
SHA512 a29a71d00c611d6faa7fcd760256349e0273cb451a158eedfe056672da05932926b89531662bbb9bf912f5061413d26b09c5c636cb5b45c0aadad2e77d2af323
SSDEEP 192:4RjjFzE7WUGv7VJpAPRp2hW9fHXS8b+WNnd5+iB2c4kQdzzwVyIsnAUge:4Rj5uyvUXFhXJ7l2chQdMe
TLSH
T1BC42932EBA10793B9CDBD32AF9617663E7F6102225951E84E6FCC93C15E76CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e76ac5c1-4d67-4c2f-aed8-061ab32763f4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e76ac5c1-4d67-4c2f-aed8-061ab32763f4.tmp
Size 13KB
SHA256 47bafcba0499f71e14b3162342e33154a72e67dc51588433756299ea307615d1
MD5 5f00cbd63dd2a6a36434039b77b97848
SHA1 e3173ea77ead98527fba62a2544b3077b557cfe8
SHA512 c6ed01c191c74cb786bf09be332ee4803dc3b6b19e9ca00ed975fce5dbebb1cc71c4efc7cd6e97e6d1b291c5798eea2805d25a3ea9690e02cd29d7c85e29a445
SSDEEP 192:4RjjFzE7WUlv7VJpmPRpIFLH59fHXSJ1sb+WNTEd5+lKxNq2cBkQdzzKVyIsnAU3:4Rj5uVviX+hX61wEJ62c2QdCE
TLSH
T10352932AA910397BADEBD32AF951B763E7F5202225911E84E6FCC93C15E76CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb74d137-2aab-4a68-adfb-91652de3fb6f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eb74d137-2aab-4a68-adfb-91652de3fb6f.tmp
Size 13KB
SHA256 faeb393fa9d64e54a7c10cd15492bf1b0c3b51156e29d0cc600185bb59fc54c4
MD5 f7b7c3447e7094cb43383bc83beb67ba
SHA1 148cbc490572441514f8e002b1f569dd857c44b5
SHA512 5f42db04514cb85a10017230514ad2f0ab73fecf39446166f4d4f37529f8306e5ded5a7f6ceca6c96644a4a4595c7a2562eedd56cb967b2e4305dfdc5a3da115
SSDEEP 192:4RjjFzE7WUMv7VJpAPRp2F8HV59fHXS8b+WNTEd5+lKecpkQdzzwVyIsnAUge:4Rj5uYvUXJ5hXJEJecOQdMe
TLSH
T12752832EEA10397B9DDBD32AF961B663D7F6102221951E84EAFCC93C15E76CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a29743f9-b7b2-4b4b-893e-a9d6ab9a987d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a29743f9-b7b2-4b4b-893e-a9d6ab9a987d.tmp
Size 131KB
SHA256 69974cdd155588de839ae3ba905b2b5dde8d7832c43ece2a98a5ca289feb0688
MD5 9cbcd971030e3d4dc0875ba783dbd1e9
SHA1 82ab52d6eb09b400922f04bd854ac395e25a231f
SHA512 a820a977581793ab976689dee85a83b3be11579aeef8b701d0b64197b9c5700836515b28c8a3b26fa678c0766f79040f510a4c63b722694bcdc96d65d8f13a0b
SSDEEP 3072:SJZ+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:Sv+hFD+7t56OD9ZfSAppr3
TLSH
T1FFD31232AA55D87BC9FD6542F147A300DD6268ED45DE3A0D844A9F8EA09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6da8308-a4d4-4a6a-9466-0fa313aca06d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b6da8308-a4d4-4a6a-9466-0fa313aca06d.tmp
Size 131KB
SHA256 d4d22b5abd6b79f7ccc06b8114d9edc5b6d31c42069d4b70f44516675d591ff7
MD5 55898bd4c8ff9a8e02b1a9fcee43c3bb
SHA1 ef9a99b23ef18eed3304fe31b16fe552da15bf37
SHA512 040b633bcebd34de7cf3579c75d48a58b3e12dfc572db1cd02fa319d846ae458a0024f0c8353cc4922fb28b69e773f6bffb455b36c8d579310b3c14814eea9d5
SSDEEP 3072:pJv+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:pd+hFD+7t56OD9ZfSAppr3
TLSH
T141D302326A94D8B7C9FD6541F157A300CE6268ED45DE3A09844A9F8EE19FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5406aab-3835-49a9-a107-4dc37ce3d68e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e5406aab-3835-49a9-a107-4dc37ce3d68e.tmp
Size 182KB
SHA256 627d2b77452ba3fdea426dc06eb10a8d1ec04e5469be7b27859c9a67296df791
MD5 d1dd84b366259e4e2c505ce1c769b598
SHA1 53298df2ebc0a39c6b3cce5acc64189df0960ac4
SHA512 cce3e88388f082d4330d9f5ed15c60cabf5dccb65ddaad03add4a3e396f9444136c35a40966dab6d732bc26a0d0b4264f5f29959095ffeec2e935672831b27f1
SSDEEP 3072:2JQTk5IYBB4WmN8AFJq+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8L:2iTAIg4nDFJq+hFD+7t56OD9ZfSAppr3
TLSH
T1880412736794E8B7C5F420017587B314DEA26DDE46DA7A8A85464FCB90EF80C05B3A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download