0b6a88afb192a66a82f76e857e101f221cbdb53ca5571efa6e225df8c1ac9273

Analysis

user interaction
yes
max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMMORTAL.exe
Size 382KB
Sample261029-151c3ace96
SHA256 0b6a88afb192a66a82f76e857e101f221cbdb53ca5571efa6e225df8c1ac9273
MD5 a44daf3afc01a0b6fdd7c8f4db84a36c
SHA1 54c22a1b1395678125cba11fdab9d61e893805b9
SHA512 0a559d119eba4560339e78c069e3c94a20caa7702eb2e957ac3f447a0d47e6ac84d543b8a76d542a91eb10525e5a04c9c762bc69b2c4657f8883004fa65f676d
SSDEEP 6144:NVbriEWbJZlkfLvKmLak/0NssDa+tncHU1lirDfV0jmLqk/0NssDa+tncHU1li:rAqftsDaKncHuc0SsDaKncHu
TLSH
T13784AEA1B6D02CCAF671527806E5E122B33DF9E047238F0B55606A361F53F813ED9A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IMMORTAL = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\IMMORTAL.exe\" --reapply"	IMMORTAL.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 7 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	IMMORTAL.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Hostname = "DESKTOP-CB601D75D3AF"	IMMORTAL.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Domain	IMMORTAL.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	IMMORTAL.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Hostname = "DESKTOP-DB070318810E"	IMMORTAL.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Hostname = "DESKTOP-1B55B8B821B2"	IMMORTAL.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NV Domain	IMMORTAL.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2320	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3656	chrome.exe
3656	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe
Token: SeShutdownPrivilege	3656	chrome.exe
Token: SeCreatePagefilePrivilege	3656	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
4372	IMMORTAL.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe
3656	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 224	3656	chrome.exe	95
PID 3656 wrote to memory of 3028	3656	chrome.exe	96
PID 3656 wrote to memory of 3028	3656	chrome.exe	96
PID 3656 wrote to memory of 2320	3656	chrome.exe	97
PID 3656 wrote to memory of 2340	3656	chrome.exe	98
PID 3656 wrote to memory of 2340	3656	chrome.exe	98
PID 3656 wrote to memory of 3216	3656	chrome.exe	100
PID 3656 wrote to memory of 3840	3656	chrome.exe	101
PID 3656 wrote to memory of 3216	3656	chrome.exe	100
PID 3656 wrote to memory of 3840	3656	chrome.exe	101
PID 3656 wrote to memory of 2260	3656	chrome.exe	102
PID 3656 wrote to memory of 2260	3656	chrome.exe	102
PID 3656 wrote to memory of 3740	3656	chrome.exe	103
PID 3656 wrote to memory of 3740	3656	chrome.exe	103
PID 3656 wrote to memory of 4132	3656	chrome.exe	104
PID 3656 wrote to memory of 4132	3656	chrome.exe	104
PID 3656 wrote to memory of 1912	3656	chrome.exe	105
PID 3656 wrote to memory of 1912	3656	chrome.exe	105
PID 3656 wrote to memory of 4016	3656	chrome.exe	106
PID 3656 wrote to memory of 4016	3656	chrome.exe	106
PID 3656 wrote to memory of 3876	3656	chrome.exe	108
PID 3656 wrote to memory of 3876	3656	chrome.exe	108
PID 3656 wrote to memory of 5100	3656	chrome.exe	109
PID 3656 wrote to memory of 5100	3656	chrome.exe	109
PID 3656 wrote to memory of 1928	3656	chrome.exe	111
PID 3656 wrote to memory of 716	3656	chrome.exe	113
PID 3656 wrote to memory of 4876	3656	chrome.exe	114
PID 3656 wrote to memory of 3976	3656	chrome.exe	115

C:\Users\Admin\AppData\Local\Temp\IMMORTAL.exe
"C:\Users\Admin\AppData\Local\Temp\IMMORTAL.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
PID:4372

C:\Users\Admin\AppData\Local\Temp\IMMORTAL.exe
"C:\Users\Admin\AppData\Local\Temp\IMMORTAL.exe" --reapply
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa9b6dc728,0x7ffa9b6dc734,0x7ffa9b6dc740
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,10757449926659078339,13781147716231251996,262144 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,5839114741931500110,15988186923495278773,524288 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,4819533352336333080,7153621227655788755,524288 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,9026705113804431515,8981093369089789578,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,353690889048251128,6272659212683154862,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,10694460623090818014,6647640248947539072,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,10246846152608520048,8596201113359952366,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4956,i,1809321837278283386,5529726360204657011,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4764,i,7985933483600058898,13429587222067975737,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3324,i,17196304935760049567,12672126773795075488,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5128,i,12780938639924982376,3991567475546880389,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5188,i,9955715742030128258,5288263632684889475,2097152 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,12023034519457740069,4639088542689298302,524288 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,7370953978953558983,6541365975143316514,524288 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,3540427951588095182,17844971872897662281,524288 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=240 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,11531931072370316886,10969773582618366127,524288 --field-trial-handle=1984,i,280629141225265035,12428584207771826003,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:3976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12290fba-0791-427d-95ca-04113b3f6a07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\12290fba-0791-427d-95ca-04113b3f6a07.tmp
Size 270KB
SHA256 b237c42cf003ab3fa90ce280fbdc2ef3e55060c3f231eeba7adc0b3edae573cd
MD5 35e2c1a69804e52bd71183516d7690bd
SHA1 e24b42d444ef59b5ca2d80dd2f35f7d8d418bd45
SHA512 b7111dd2645ef6e9f3385a4c189d815069ecda668dc02cbe0a22d09c3cc59b218de9fbd9a5bab0620c9def8548d5ed292b8aac16ec96e2b09649391544b9eeb7
SSDEEP 6144:G3fYHZV9EONkgDLrKQ6087qtBzpiBO+hFD+7t56OD9ZfSApprP:2wHr9EONBPDxztBzp8OyFSXD9ZfS4R
TLSH
T10A441332A95B9DBB8AEC1541908EB3046A659CFB84EF5E4840036FCFE18AD5D0763D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 6c819db0734bfc935c63a42a6712058d6e87eb2d95f26b8e6caba4343fef250d
MD5 5d4465f007be84d401efd8ce339bdaae
SHA1 69994fdcc3188edee330493acac43550aad590f4
SHA512 172ce455e13ca65ea3a0dfaf4bd1df651e2423b5386930107c85e61e0374e6eac041602f6df06c15f953d9c1eec6c37938cc1096979f6ee7f2797695bb65197d
MD5 SHA1 SHA512

Submit Download

0d66f3f6-573f-4c79-82b2-31f5e0c2023d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d66f3f6-573f-4c79-82b2-31f5e0c2023d.tmp
Size 17KB
SHA256 523761bc1813672aed3255e4becb28be826b1abc952b1618d2bcfadebfe5e21c
MD5 472d61bcf21443a047dac261aad552e8
SHA1 608e068876727f4f676b88d75ee81c5361cbab00
SHA512 c732c8cc57effcc49d70faf34528b26e9138b9a4c90bc7197c1b7efc3bd7d6aa9914d2b1dd802f59451918a42148b21a62cf31325f4ca0e95e28d8b96bbf35b5
SSDEEP 384:TNj/O7KxkXqKf/pUZNCgVLH2Hfgsl5S7pLuLceSZkXOD/q+ErU3v7HGISxpQ8:TN/O7KxkXqKf/pUZNCgVLH2HfgsvS7pC
TLSH
T11472F867BC489A3B0F94C6CCD8167B4FEDB9024B65E9886446FB983503D4ADF11062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26daf7af-4e21-4e11-b9ce-3bccd1d9262a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\26daf7af-4e21-4e11-b9ce-3bccd1d9262a.tmp
Size 13KB
SHA256 9f617ec93e4c802e2d7935bfb16f3ab0a7098a281f6000d4a40d6ef3c38f3376
MD5 e17a5ee16b5729e9f024b6c8b1b0fb70
SHA1 84d637cb24a7cf615d3a3064ff0c2f1352566d8f
SHA512 57078a1933cef958cdf905854e214aff64959f56ebc4b85e31c73b9fa624d50074fffcde032246633310d9edf6e441169090279890bdd30d5dcf0bd979f6b5e4
SSDEEP 384:IRxJmzaY5uX+vUXMUwEf2S2qjalSUZjUc8:amzamQ0zUw7S2ta
TLSH
T11E52B62EED14793B5DDBC22AF9227B57E7F9102160942E84E6FC893C14E79CD621701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9dab0271-4937-4e10-9e7d-85b0f92d2555.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9dab0271-4937-4e10-9e7d-85b0f92d2555.tmp
Size 12KB
SHA256 780f34ecbec1ace1c843f269d3f560ee9586d15a8f8cb253f3c7fce34ef6e1f6
MD5 605ee009913e1f65bc2d9d6c1892928c
SHA1 cbaeb9455b7aa07a53bdd73557500641846c5515
SHA512 91ee574d24c5620c1bc533a321e029c6fc11cf4edc0ca0d40bb363ae6ed573cdac7d5d01da4baa2dc3aa28c138d67a3b8d9ae6068c9d8f46b4b1f27377f92eb2
SSDEEP 192:IRxVazM5BsJxXSv7TpAPRp2WgG69WHsb+WNnRm4fIn2AXf2+PjalSUJbjKd4VyIy:IRxVaY5uX+vUXkUwEf2S2qjalSUZjUce
TLSH
T1D552B72EED14793B5DDBD22AF9227B57E7F9102160942E84E6FC893C14E79CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 350KB
SHA256 7cf60efe182c0c85b02ff13cbad26b1836c1798bd9a5f3a0b85bf89ff047c5aa
MD5 334b0fa1adf3ccf225d87afcef3894d5
SHA1 5e9af360ce30f803a1df1bc027ef68d5cd8dfa37
SHA512 680bfc7646e1a57eddd441c64fee3d50cb8aa47bf1eb68660bccc3ce7b92bc51824a3c0c6f9f0c6a36cb9fde842167a980f103e5b59bc484d645999af9f1ac18
SSDEEP 6144:wZpDEwRnuLHBNUjtt7heEW7eSh21T5TKK2lSu1raoZYlbo:wZdEwRuHsh17SmNTKKLo5
TLSH
T1D574237905C189E0804F12F6F6646E5F629E318E5F23FC0EFB66E587A16F1922F21748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 744B
SHA256 315286c93cb84f7bb8ff64a2d5ed3681ac0f3d5b42fb5179489883b2d966f356
MD5 6bd78dfe2b093613d0eb5fa9da087d3d
SHA1 abbe9c156bfb659f94e1e17a378f8b9143891b1f
SHA512 6087062adbce028a335ffb46041ff7694cf4ea34dbb8d833d81094eaa3ad1a3b8ba7797b473828973867bafd1ee2409a8d6bc6bc18710d944efef281dcef49e0
TLSH
T13801464AED05B820CB5A9BB09C1B00558CD96B3BB022D3F54150E179FDAE06E7B21E35
MD5 SHA1 SHA512 TLSH

Submit Download

3e2bd637-d2ca-43d3-8a5c-1b12b163860a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3e2bd637-d2ca-43d3-8a5c-1b12b163860a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7a889b58-0844-4bf2-b63a-4ccb339bd510.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7a889b58-0844-4bf2-b63a-4ccb339bd510.tmp
Size 5KB
SHA256 15a734b88b887a01402bd7ab7a131a9d0d6ec90bf7647e329f0ec4fff1f3c4d5
MD5 825be6b68bef7f3c0e76fbe7b21c1d8e
SHA1 7fadafd06c591431574669b7bc87c76651c0b8ef
SHA512 52fbf54dd3e4d690faa8f0a6bf400ae1dd83a2157ee80748616d0c922265227ea59b8d3afae834c9655350142bb46dcbf75ac107b66bbcc33e984299616add1e
SSDEEP 48:YALlqPqyh4hJhBhthLaXYfoKsRgmzstfsMosyKsef+sLts1eJzskBsF1PswI1sWt:DMLaj/XlaIG6pisl7HY1pIZI9I4cbQE
TLSH
T1F7C1AEF3C3D8C52D890156F49B25AF1FCE2A1A18431C3C67C8D8AE5B93F2971E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1c13fc1-e31a-4236-a5b0-880e262f98ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e1c13fc1-e31a-4236-a5b0-880e262f98ce.tmp
Size 523B
SHA256 c609f6a339a7f6eed35e1941fa714fc851217ad4f614fb091e9a8d57c2c854cb
MD5 080c5a794a76bd75be9690fc03a45993
SHA1 f91b9ffc10327e07978ec2f7a25498ebf06c1c92
SHA512 23a4e2f35ed0e44dcfe2ce4c65680d890d684ec133e5909003f2a0d934b7c0547421a624f257e39aa2b1535cd5a06e1344708355addad534a873c9892559fb34
TLSH
T19BF0C9ABAA3E712351BE89A71D04B80969B6AC34078058F4CF5A826DA0C05A31F12003
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 14ae590c477e953ca15795dbecd870ebf3a2f158d9c0861cbc8f4b7cafb9e4c8
MD5 05c6dad25224ba2fc47e533473dfafd2
SHA1 9f717f4f835d1338a5a561a2d520ed404f32303b
SHA512 b6741ffcc8cd516f36c1747e66f56a3fda231cbee0f79901f088666ebd2d8074f4ae46b5f3cbf8d753672b79dbe34ed097ebba3a5926d6deda06d4c6b4fd1a1d
TLSH
T136B0124880456741C41A03F8115024CC7558DF16E605134142F00E91A835150901B055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 58693084a5924147f8c65f52afa6258447027230646737e2b13e95d61add4fb3
MD5 ecfcb43af47d89d837c66338e576a19a
SHA1 9588d2152b3613c301a008adde4e4f9da7e689d2
SHA512 310369ad867ea66e7d0b71e31bdb8cc4893c112fae1d70ec6b596ebe9ec80b09e9c1aafd2ced60a1ca839f024bf9b5eb1d2dcc63c0544003a6f475fea386b9ff
TLSH
T10CB022A0E0023203C00203B038CA88FC3020EF22C203030282E00A32EC202B00223230
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 ea3703e626ca527a43f01230f1f048ba1c14ee4a3590466838720bd0071c4cd9
MD5 61e72a82bed7d76abaf8837d58cd3aeb
SHA1 3c716e53defbcc078d2be2a7f0105081880fc57b
SHA512 de6c73f449dd88072e96ea1a83365753ab376c8539d6b38990ec9c015930f0edd5ee7fe3fd1097f8b4bd2aee82d0da70799b02d39dbc7f5e1afb2cd21058238c
TLSH
T166A0029147511640C00806B0926111C0770CBF1107865F16609240D88961A8B5106310
MD5 SHA1 SHA512 TLSH

Submit Download

b279bfa8-668a-4e1d-ae9f-f79e323c55c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b279bfa8-668a-4e1d-ae9f-f79e323c55c7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

bff0cb69-2460-4890-9898-db533e464549.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bff0cb69-2460-4890-9898-db533e464549.tmp
Size 414B
SHA256 6826858ec4e1d284622e7cbabe14eb55cd7031ce0d1aee31697953b870e72f6e
MD5 f8ca3d4a5a0bcc1395acbbc08fb4d594
SHA1 2d592f7c54f7549c3cb7c06d9a0889fd702d27fb
SHA512 700fd6f21c66b71414159f6b908c2d0c3110f04ee076d934d37a07ecc4012a1e685d778bc00d4925f86666783bdf34ee80ee26e8295a45c4f2c90c9a83ab69df
TLSH
T1D7E02B6AC961EC3709FD571C54515646EB5023273B90884F373CC20C8FB163E058A81C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 f0e0ad7570a0b2274b9028e31a53003977cdde7a30996f6e65f379806e78c6fd
MD5 5702d6fb7740c50d591d1d157b27bb18
SHA1 f811ddcb5a34636316b12076605e0168a0dc5f05
SHA512 3490bad5cc4b6af11a2d9a09973bafbae2c8b5d3f09774e8e6ef7f0d1f009bcf301f1b581ee36147c8ed84b2c20015b07336442f21957ac79cc160c6b6331ebc
SSDEEP 3:MsEllllkEthXllkl2zEklSUlll:/M/xT02znS8/
TLSH
T15D4404047FC4140DC51010704431C3500370D4130513D7C334750D335CCD5441C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e926e41c-2a5c-43fc-8950-521fae36d84b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e926e41c-2a5c-43fc-8950-521fae36d84b.tmp
Size 130KB
SHA256 7721730c315a372be0d203f8d5e72048f0dd8f02eb33dea805b1108ce631b6fb
MD5 3ba9dc437c678e60d4360af8f66c75fa
SHA1 246504412f6ea829bbad96f7e14918a039d559d4
SHA512 1d33be668d869d1ecf5778a7e3c6d3f0d2afe65787bb2167d032958ae484f8fb807c673bf312f241caea28d42aaa276a9857f657539dd27ed82923c7ec7ebc26
SSDEEP 3072:d+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gU:d+hFD+7t56OD9ZfSApprU
TLSH
T127D31232AA91D8BBC9FD5541B157A300DD666CED41DE2B09444A5F8EE09FC4D07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eef5d940-44bc-46de-bda2-30eb93e871a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eef5d940-44bc-46de-bda2-30eb93e871a7.tmp
Size 131KB
SHA256 81d7db6a703ce96b51bc733b9871cd3abc34ed898bb3a3a276307c3321479d7e
MD5 e81eea4f94471b95cebf8c9a185afcf5
SHA1 71298c53b2a9d5d662931607e065316d7515bb70
SHA512 3e9158db7aaae6354e950b35e92f9f0ef96312be6be94e9a5019558d9b887a786adfa9c6af4871c317f09f4d6e918a140f024560d23a7dc087816850bf195673
SSDEEP 3072:/o+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:A+hFD+7t56OD9ZfSApprZ
TLSH
T1F4D31232A994D87BC9FD6541F147A300DE6268EE41DE6A09444A4F8EE0DFC4D07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

immortal.log

Path C:\Users\Admin\AppData\Local\Temp\immortal.log
Size 107B
SHA256 a3bd175ab7d6bb307e37f0f9c12e09731c7e0a3de8fec7efb6a619663fdbddad
MD5 fcaa76f7be7eb8f717845e0d65f7640d
SHA1 d1971e673fefc4864b415fc061bbea678dad04ad
SHA512 9c1754f808a85446d13f040f08b156c72df4e8eece093d4fb3a282bb1eb92167da9e70654ea985f2bc608fb2bdb44a1cc53c36d05f0fe0b4cadbb25f066377de
TLSH
T168B0925F80E3007294040B5A9550F38000C8FF67A2C38088788255193A21E2D032A11A
MD5 SHA1 SHA512 TLSH

Submit Download

journal.txt

Path C:\Users\Admin\AppData\Local\Temp\journal.txt
Size 363B
SHA256 5550a31e5cd6b613d39b96aa326138aa9c985f8be4f8082643b00f8d411ee689
MD5 67be404e03452f658ab17ad259e59cf2
SHA1 8b5fac6d59e3e459d9ed8f39f814c06580d6dd15
SHA512 d3230dc2967a83022a7936abf24b825aa0b8a767f0079a4e6d99027e04dfe942dc855a8ecdb48d0904e7316478bf73a9e09754d43798fc51d0a106a5fc05613e
TLSH
T1BAE0ED9583248011F8F0B29004EB8A61277C838B30A7FB2B2189E6206B673DA805D0DB
MD5 SHA1 SHA512 TLSH

Submit Download

journal.txt

Path C:\Users\Admin\AppData\Local\Temp\journal.txt
Size 675B
SHA256 e241c384aef52d7a4d947bfb1acd74f5e1ea6ace72e66fea389aba8a1f7f1bd7
MD5 7148d8e07e5df949476bcebbb47aaa67
SHA1 e3eca97c4e5a3d439a20a394e29d168685b069d5
SHA512 af8f37ec0890f4f3df73710bcac7c6ec47b10c3aa1855ef20551936e3992838dd36ccb3d9ba701830a75e239a7d30dc6a60103dc9822179ba65c41827697c4d3
TLSH
T1CE01489183258421F5B1B255069F8E51177C93CB30D7E72B1089E6106BE73AAC45A4DF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2488-20-0x00007FF78E2F0000-0x00007FF78E35E000-memory.dmp

Download

memory/4372-59-0x00007FF78E2F0000-0x00007FF78E35E000-memory.dmp

Download

memory/4372-21-0x00007FF78E2F0000-0x00007FF78E35E000-memory.dmp

Download

memory/4372-5-0x00007FF78E2F0000-0x00007FF78E35E000-memory.dmp

Download

memory/4372-306-0x00007FF78E2F0000-0x00007FF78E35E000-memory.dmp

Download

memory/4372-307-0x00007FF78E2F0000-0x00007FF78E35E000-memory.dmp

Download