a39fa94c62c0b98c6a478b98645ca178038291e0d642192f9678f811a250564f

Analysis

user interaction
yes
max time kernel
1050s
max time network
1024s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fortriage.js
Size 145KB
Sample261029-1le8sae16w
SHA256 a39fa94c62c0b98c6a478b98645ca178038291e0d642192f9678f811a250564f
MD5 7caceb76c9a759e24fa33139a7e9154d
SHA1 1eec3dde789ecd9ddff8ee05713884a854f764fd
SHA512 2e9a8853e0d84933d8da18e0e0ebb4425a51aef6b389a8c7a806ffa08662b0853b2e1c49b60e7fa68b33ffcd7693819813b237a540d2975045790bb2e86a94c4
SSDEEP 3:HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH:HH
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery execution

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
74	ipinfo.io
81	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
4000	chrome.exe
4000	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe
5012	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2140	5012	chrome.exe	94
PID 5012 wrote to memory of 3256	5012	chrome.exe	95
PID 5012 wrote to memory of 3256	5012	chrome.exe	95
PID 5012 wrote to memory of 4972	5012	chrome.exe	96
PID 5012 wrote to memory of 4388	5012	chrome.exe	98
PID 5012 wrote to memory of 4388	5012	chrome.exe	98
PID 5012 wrote to memory of 2040	5012	chrome.exe	99
PID 5012 wrote to memory of 2040	5012	chrome.exe	99
PID 5012 wrote to memory of 3792	5012	chrome.exe	100
PID 5012 wrote to memory of 3792	5012	chrome.exe	100
PID 5012 wrote to memory of 4540	5012	chrome.exe	101
PID 5012 wrote to memory of 4540	5012	chrome.exe	101
PID 5012 wrote to memory of 1400	5012	chrome.exe	102
PID 5012 wrote to memory of 1400	5012	chrome.exe	102
PID 5012 wrote to memory of 3180	5012	chrome.exe	103
PID 5012 wrote to memory of 3440	5012	chrome.exe	107
PID 5012 wrote to memory of 3440	5012	chrome.exe	107
PID 5012 wrote to memory of 1060	5012	chrome.exe	108
PID 5012 wrote to memory of 1060	5012	chrome.exe	108
PID 5012 wrote to memory of 1696	5012	chrome.exe	109
PID 5012 wrote to memory of 1696	5012	chrome.exe	109
PID 5012 wrote to memory of 3372	5012	chrome.exe	110
PID 5012 wrote to memory of 3760	5012	chrome.exe	111
PID 5012 wrote to memory of 3944	5012	chrome.exe	112
PID 5012 wrote to memory of 4000	5012	chrome.exe	113
PID 5012 wrote to memory of 4916	5012	chrome.exe	114
PID 5012 wrote to memory of 4916	5012	chrome.exe	114

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\fortriage.js
1⤵
PID:1016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa21f4c728,0x7ffa21f4c734,0x7ffa21f4c740
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,14041900905638275955,12198076514010334935,262144 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,6557027581239544337,3907978129724819955,524288 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1816,i,17724329015526947226,16469304348229408371,524288 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,17906166749798527126,5458660199604650647,2097152 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,2506315377863598474,3471369309453882751,2097152 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,10688601588184759456,10349927548626461891,2097152 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4484 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,14291035255161544249,14712739862020680145,2097152 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,264780223387705547,7809028106981037470,524288 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5988,i,7499830870554590368,8809714051024726217,2097152 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4776,i,260256539920160586,13018979200199885619,2097152 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4628,i,12141090978631030559,5584873743662859193,2097152 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,7114364709228884933,1252313551687905654,524288 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4656 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3524,i,12319638145321972147,2973381885792896467,524288 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3500,i,5313591809957018311,14937166714457255305,524288 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5648,i,16110281452646337022,10398636585061560375,262144 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,13607471250364969326,7724823054076400633,524288 --field-trial-handle=1968,i,10192821849489352472,13325238401784205030,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1536 /prefetch:8
  2⤵
  PID:4916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

60947948-3885-472e-8624-d85a581ab90a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\60947948-3885-472e-8624-d85a581ab90a.tmp
Size 271KB
SHA256 d167be11b2d763088b7c2ce143d008f78a24a5f99fff7e04f1f8462d35a888df
MD5 255471949004812a74df22bf9d8e43af
SHA1 28d74172c7f7da767688805fe21de3beb7f12f3c
SHA512 e945a7071f9754f7902eaa6c5777c6e911a51f3e5aad65439d84af4d173b056f7bce35ccf7bc8a041ddab3b426a4951d7626ae6bf6b5233d173f4f7a9a2351e5
SSDEEP 6144:TE3fYHZV9EONkgDLrKQ6087qtBzpiBA+hFD+7t56OD9ZfSApprb:8wHr9EONBPDxztBzp8AyFSXD9ZfS4Z
TLSH
T188441332A9579CBB8AEC2541904EB3046E559CFB89DF6E4C80037F8FE14A9590B53D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82ba1efd-e6fe-4eab-b043-19db041e6e4b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\82ba1efd-e6fe-4eab-b043-19db041e6e4b.tmp
Size 270KB
SHA256 7ec0d6d2160aa6589d732428e57ea3a35b46acf1ddebb41067e46379d01dfd13
MD5 ba7f360bde971a4dac968e913a54fe30
SHA1 bdd661bc4b2a08d1362aeb54ae5c3b7b9c303ea8
SHA512 92b21fee06abafec1f54656f8490142e6fd2dd7f132100dda59daa77fca90c8cf342571878407888c3be165a7271c7596676b5dbd1dc573223be18c86dc6e78f
SSDEEP 6144:zoX3fYHZV9EONkgDLrKQ6087qtBzpiBA+hFD+7t56OD9ZfSApprb:zoHwHr9EONBPDxztBzp8AyFSXD9ZfS4Z
TLSH
T17E441332A95B9DBB8AEC1541904EB3046A659CFB84EF5E488003AFCFE14AD590763D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f92e5f1-8cc0-4366-816a-b4bc79fe7ca8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8f92e5f1-8cc0-4366-816a-b4bc79fe7ca8.tmp
Size 271KB
SHA256 5656acb59f51e9a87283535bb9928fa1a31f108be667cf003ca56c3667c82d7d
MD5 dbf5796ed138b9c4776cdfa848bb29eb
SHA1 9ca15a9b836a2311bfebe3b6b12e41287a262885
SHA512 016962161eb70a1debcc4905782a6ed7f24a679bf3ceeb413f415776b4a3d933eac8d7982b751a80421045c8d8402fbdbb170a4a6ec0c5d553855d66d75318e5
SSDEEP 6144:vE3fYHZV9EONkgDLrKQ6087qtBzpiBA+hFD+7t56OD9ZfSApprb:AwHr9EONBPDxztBzp8AyFSXD9ZfS4Z
TLSH
T115441332A9579CBB8AEC2541904EB3046E559CEB89EF6E4C80037F8FE14AD590B53D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32f0a226-3d11-46b9-a350-2d052a3d60a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\32f0a226-3d11-46b9-a350-2d052a3d60a5.tmp
Size 12KB
SHA256 2b25c8de97456c2e6614944114be4926d3740714f63290e5c60e66d278678e66
MD5 bebfda50cab09a74238236ec4355c7c5
SHA1 f4d224f044854c9c09b9093ae5c8161f8dfe257e
SHA512 c0c52838356900b5b2e6f7a7c06f2f766e1dfa584c47308543ae6984c83297c8940b529f1a8ec78fc3963063585f84f900540d647be3887b9432d7e9a1ab6cce
SSDEEP 192:KR0fzkhZXudYdcv7+pAPRp289THsb+WNnLR07UeO2H1PbayVyIsnAUgtaJ:KR0faZDIaUX79wV042H1Tay8
TLSH
T189429529FE10797B5CEBC22DEA627B93D7F5103161942E80EAFC892C15E75CC261742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

412c8f47-e5f6-45eb-b001-ad470ef7957b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\412c8f47-e5f6-45eb-b001-ad470ef7957b.tmp
Size 13KB
SHA256 652eb9a6b66d1c87326f843bc782ff22ba0a453f41b7ddfcb05935425da2285f
MD5 65717b711b35fcff6635d3dabe08d91e
SHA1 a7ce86c624c897fac12169722865bffc1dab0dbc
SHA512 8e41c184584eabe5feccb474a93001cbc238242189f9975062570ce2292e83f3e0a7ccc73e485a02d5499eadbdf5b481a25d77dff162e60ac2d8d0a5765a88a1
SSDEEP 192:KR0fyhkhZXudYqev7+pOiPRprJXH9THsb+WNnLRZ7x2exUeO2H1PbaQVyIsnAUge:KR0fyYZcaagkXrZ9wVCeK2H1TaUe
TLSH
T16352B52ABA10797B5CEBC22DFA527B97D7F5103161902E80E6FC893C15E75CD261702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74b322dd-0e6f-4caf-b41c-781d0c41eba1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\74b322dd-0e6f-4caf-b41c-781d0c41eba1.tmp
Size 12KB
SHA256 ac442f1943c2919e425eccbab3a0ff522a72351ebb96b827303d4563b0495e80
MD5 68e6e3253b3693be2f579396f1da8f95
SHA1 5e9a3746faa5e5458dcbc3809b3f96a0728b7026
SHA512 7952a5d95887fe9dc4231c07bcba85e3db9d464a538ff28a8b4eec4bb0da2c3c3b857579d65e6b5258b8b6ab7ca6da975fb0f7ce53e95f6ddb4327e503d0e62b
SSDEEP 192:KR0fzkhZXudYqcv7+pAPRp2XH9THsb+WNnLRZ7zx2LUeO2H1PbayVyIsnAUgtaJ:KR0faZcIaUXG9wVP2I2H1Tay8
TLSH
T18342B62AFE10793B5CEBC22DEA627B97D7F5103161902E80E6FC892C15E75CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

924e6abb-415a-4440-99e2-8511ce19a960.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\924e6abb-415a-4440-99e2-8511ce19a960.tmp
Size 414B
SHA256 4d38d55dac7ba364fc3d02b9edc7687e7ddc3354142b5fa672d95d7f2439c92f
MD5 9fc7a76f86bacb48e0421839ab6b98dd
SHA1 5d323f52628ffe6dbdcc8c3a965a7e002e63df16
SHA512 de759856a91e599f00d8cc1cf61badea3ea0714800c052fadb1f46cecec055a11020bb321247d3254a92a4e7698c9c5123f077496fce80034ec6ca3f15367016
TLSH
T10FE02BEAC922EC3718FD0B5D54911A4AEF4023972B41494F3B3D81098FF173B06C586C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 480B
SHA256 11019242d4858d7e9a9f21bd0aa00a98448568ff756c4ef327dd7ae521a56ead
MD5 c7852096d6383dbc51c3354c87be309c
SHA1 60cee62c816e8808094cc911637dc38780510b68
SHA512 2fc9c9a117bf38bf031809dabf11f69dab56ee2308214afb0072b794041fa12cb07e0968c88629dd2b9b30bcb4f1e5b71b6ec8bd650247f584898217a8ca5a71
TLSH
T133F0DF0844E13120DBBFDEBD1CC27824F2770A0848530DA2C98C62F28DE638410A2393
MD5 SHA1 SHA512 TLSH

Submit Download

0bee1975-a25e-463e-bc66-c8d5890a78fe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0bee1975-a25e-463e-bc66-c8d5890a78fe.tmp
Size 6KB
SHA256 8e863e0b6f12cfcdd6ef95832ef69c88eedc2041153a5e99a8aa0ff56616c515
MD5 f5d2f7397f481f53015f3567c91f67ac
SHA1 d346f867c5cb6b01d5dd596c0355617efc8d1911
SHA512 3228c18043568fad4b93d26318393421ab1d04b2afa826546cf823399ea7eba033f90777afd56065d36780bfc839570d82a7add6901b4e758249cadb2965f4cf
SSDEEP 192:D0uVjJRhBKaIefxEd7WCPBLs3DCqkFGHEj7RDsSzjhnTdK:D0uV1RhBKaIefxEd7WCPBLs3DlkFGHae
TLSH
T1D5E17AF783E4CE7EDA0162F4A7156E2FCD690915062C3C6A88D4AE1BD3E2471E24079E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24916e25-0d1c-420d-b024-1b02499083d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\24916e25-0d1c-420d-b024-1b02499083d0.tmp
Size 6KB
SHA256 c7ef8a61695ac168819bc0c0cf16891fa8a755abef71e9ebcffd6406382edf54
MD5 c8429488818c9268cb079bc4cc058c8b
SHA1 79a042a414b4b226d8909564c103677e0ee1b9ae
SHA512 69ecfca5306afbaeab61cd636593b298b6ee3fa140fbd7b5b8f6956a3b2b21187b210fa2673f767daff4fbae2faa4be7686d2d74c44f3e5ed491b17efa3d1862
SSDEEP 192:DingcJQBFaIefxhD7WCPBLs3UCqkFBy+UEj76uDNHTM:Ding4QBFaIefxhD7WCPBLs3UlkFk+Ua+
TLSH
T15BE17DF383E8CE7EDA1162F4A7152E2BCD6D0919062C3D66C8D9AE1BD3E2471D24075E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84ed7fa6-bb17-438f-9b74-2cca600440aa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\84ed7fa6-bb17-438f-9b74-2cca600440aa.tmp
Size 6KB
SHA256 c230331806a8511f004a369615123d92208d2f9a9436ea0514b61d6945bdaa4c
MD5 acacc55e962246fe9afe30f7c477ffae
SHA1 5dde291a9c56dcc7a015b42be0d7b34bfc28aa2c
SHA512 036a79eab5443bc64f6f926bad2002778d08ed32f0b0f283ae3db64b4184a647ad638a6d7d1656e738ca529c5961b00e3b4c1bc5df98b514d721744c2d2a2951
SSDEEP 192:D0uVjJRhwZaIefxEd7WCPBLs3DCqkFGHEj7RDsSzjhnTuK:D0uV1RhwZaIefxEd7WCPBLs3DlkFGHaz
TLSH
T1A6E17BF783E4CE7EDA0062F4A7156E2FCD690915072C3D6A89D4AE1BD3E2471E24079E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86abd414-da6d-4052-b7a1-23079ae2918f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\86abd414-da6d-4052-b7a1-23079ae2918f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9f485baf-988e-4a52-9955-c35c5017772b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9f485baf-988e-4a52-9955-c35c5017772b.tmp
Size 691B
SHA256 50e44f5539d5eca453e6e71f4e97452507940a027e6a7090cba954dcf3a06260
MD5 4fc055af1516cfc512ceb1fbf663c48d
SHA1 9c42acba61d0a19c68618bf81b93d87fda289729
SHA512 61185adba6eb8f09a5062fcd73c62b214d83ca73f4b7b51a569faf7a391f7cf1a8c772d901b0b3166f09999e67d1872f1c5a9493f4db5152c34422acea4e932f
TLSH
T11E0199EB9ABAB477507E84BB0D047C092AB6B838524124F0DE97837DE0C14E30F12873
MD5 SHA1 SHA512 TLSH

Submit Download

f9d2be88-705f-4390-b3a3-4ebca26c0427.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f9d2be88-705f-4390-b3a3-4ebca26c0427.tmp
Size 7KB
SHA256 fc7c9cd51e0b6445fa22d271827f61ae8cdb20ff697e665972d9adc72a7d0ac0
MD5 ebed6f32d1e27cd6e55c8ffe24f20238
SHA1 2fde8b97f3e9686a728252697c377d9293257f66
SHA512 d8c94eed31c5264e1ae96ff874608fd215790dbb538b03f5ff2ab6c91ac0a2f0fc07e33bafeadae9a957b5965a74d5634c96b24801aa51149f6591400820ce08
SSDEEP 192:DingcJQB9iaIefxhD7WCPBLs3UCqkFByHEj76uDMtXHTM:Ding4QB9iaIefxhD7WCPBLs3UlkFkHap
TLSH
T10EF17EF383E8CE7EDA1162F4A7152E2BCD6D0D19062C3D66C8D9AE1BD3E2471D24065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 077e72c03ae486c477ed656b940f9334d4f505f9c042e325a57477a2da916130
MD5 c1cd61c6f2aadb9a12ebfc253693f4fe
SHA1 26afc0a62e869439120f647e9c3e5401afdeb33d
SHA512 bab7e2499441923c6dfa385719d2e42a487139fab039b8633d00b536cce9cfdc911d4e78163f197df6fb87b85fec5aa1c727c945939b1b31828f5ebadfee88f4
TLSH
T14BB0124584419702C40203F4115054DC7198DF20AB05170242F00D11CC36671816B054
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 5e49c2ccbfe2ca27e2c7d2924ebb51244da52ec00d59c6ddff71b9b0c76cf3e0
MD5 af3095d2dc632ea262e39583cf563f6b
SHA1 c2be2608fc43a861ee6e27e36a194164cdeaf71e
SHA512 117579e12b34a204b5c0399d9c289dd63b04621b87b1e5c88f572a4414c7d17c51f0d36986d2b1acec2064c2f6cf878827af37cb4b1ed64b0bf1ddffe7310185
TLSH
T161B02208C002A322C00303B028C8A0CC3020EF20CA03832A83F00EF2CCA02B0823E820
MD5 SHA1 SHA512 TLSH

Submit Download

ce61bf4a-9c78-40db-94fc-d7766f4afe5a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ce61bf4a-9c78-40db-94fc-d7766f4afe5a.tmp
Size 13KB
SHA256 3354886c91b57e0e1e549a624fcf095d7bf120ac423fb896555c3795ce7ffe39
MD5 22378862f80c6856e7b8805de6839aab
SHA1 0147b8be0123303822d84f3f0efecf70dce41276
SHA512 9e0660db3bdb8f94e38551426bd5fb9576db15cc52b5b413b0055fd991c20e90c24ac5334adb70104463d8a7590233e6495608baec79535ec24d5cc8b44dd3e8
SSDEEP 192:KR0fzkhZXudYqBv7+pOiPRprJXH9THsb+WNnLRZ7zx2bUeO2H1PbaQVyIsnAUgrK:KR0faZcRagkXrZ9wVP2Y2H1TaUe
TLSH
T19352B62AFA10797B5CEBC22DFA527B97D7F5103161902E80E6FC892C15E75CD261702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9fe23a9-4a07-43ef-8031-bb1b4dc4b068.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e9fe23a9-4a07-43ef-8031-bb1b4dc4b068.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ee1f5728-a108-484a-9a82-b405a5bb0c27.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ee1f5728-a108-484a-9a82-b405a5bb0c27.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fddc0bff-c966-4d32-b95c-37afff9a2374.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fddc0bff-c966-4d32-b95c-37afff9a2374.tmp
Size 13KB
SHA256 fd4079b38a0eaa6d2ad910dcbf5f98c4ca4eaf390060a285c14188514fb4e37b
MD5 69b4d6dfd4d595e934eb2e2806904f2a
SHA1 3cafab33b239422d8012b41628305816d9e31039
SHA512 dd0de09db4f8cff93778e9237f64bd18a92901065adb72de000430be11c2106712a755bba4077c1d8608f9f3a7fcf62cf0246cd8be56426cd43b7b931c5f6831
SSDEEP 192:KR0fzkhZXudYqVv7+pAPRp2XH9THsb+WNnLRZ7zx2yUeO2H1Pba8VyIsnAUgraJ:KR0faZclaUXG9wVP2H2H1TaYe
TLSH
T12D52B62AFA10797B5CEBC22DEA627B97D7F5103161902E80E6FC892C15E75CD221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 f6980298bfe77ef7d091aaa42ca8192051fef50fb6870634dacd9a7faa4f8ef8
MD5 827779580c87ce3f083537ce6f4cfb95
SHA1 1acc63731f1a3534fda4a5bee94187f4bbd9730e
SHA512 95ee1ea5bd73bbad0ffc69b10eadea1e36dac50553a8ddc76dbfe9aac5b31b8a32c916393760118b43ad44ae598bb28ecdbac85ed31de596607833223848392b
SSDEEP 3072:k+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:k+hFD+7t56OD9ZfSAppr2
TLSH
T1A9D31232AA91D8BB89BC6541B157A304DE72ACED81DE3A0944495F8EE09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc65b1ff-ae9f-41b8-b910-ba76e7da39f0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cc65b1ff-ae9f-41b8-b910-ba76e7da39f0.tmp
Size 270KB
SHA256 4ccfb325d0f7edaf3469fd51ec4efd1ecd57221ae7138cda7e31f3e5edb532ff
MD5 c7252a4d6f9fb47ec3e9d76ea8efc963
SHA1 c5a89047ab41b199f8038c291f2b03a7f867edb6
SHA512 473d9eb137610fa80b20fdf7d2298da3dab14d230afbeba7180148d67fe3a4a0cc138187c3e1bf7138cef3e928f138214c2b682bb79bd03944f062e527a80b16
SSDEEP 6144:0oX3fYHZV9EONkgDLrKQ6087qtBzpiBA+hFD+7t56OD9ZfSApprb:0oHwHr9EONBPDxztBzp8AyFSXD9ZfS4Z
TLSH
T133441332A95B9DBB8AEC1541904EB3046A659CFB84EF5E488003AFCFE14AD590763D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download