af71aefe732a4c28340323bce99f21267eb5ccf6a5e023f4e3f61efe6b915ddc

Analysis

user interaction
yes
max time kernel
40s
max time network
75s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/10/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Size 700.0MB
Sample261029-ysymlaev7v
SHA256 af71aefe732a4c28340323bce99f21267eb5ccf6a5e023f4e3f61efe6b915ddc
MD5 a6b252a552cb98826a5e7609fe77d24e
SHA1 9f36a2671227b3317334a0fc05fc3c5ff56c7d17
SHA512 528fb01cc5d8d0cee5b48b2fb2262faa935baff26c50f748caf25bf8bf7c0f581dd944011b85bb8b592c4a0af582c82bb7ecf97206278447c5b68f8599245365
SSDEEP 12582912:WZa7hmguP2nUJ2W/VGg9jvYTEooAeX+qisWDDL8ancoyMM:W4UsWUg9rYQzAeXDisWDDhnRlM
TLSH
T10D791243A2E751D8F0BBD13496E64323E573BC491B3469EF12944B312F72AE0A779B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1756	chrome.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4928	chrome.exe
4928	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	Taskmgr.exe
Token: SeSystemProfilePrivilege	4060	Taskmgr.exe
Token: SeCreateGlobalPrivilege	4060	Taskmgr.exe
Token: 33	4060	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	4060	Taskmgr.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe
Token: SeShutdownPrivilege	4928	chrome.exe
Token: SeCreatePagefilePrivilege	4928	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4060	Taskmgr.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4060	2416	launchtm.exe	83
PID 4928 wrote to memory of 2788	4928	chrome.exe	85
PID 4928 wrote to memory of 4416	4928	chrome.exe	86
PID 4928 wrote to memory of 4416	4928	chrome.exe	86
PID 4928 wrote to memory of 1756	4928	chrome.exe	87
PID 4928 wrote to memory of 2436	4928	chrome.exe	88
PID 4928 wrote to memory of 2436	4928	chrome.exe	88
PID 4928 wrote to memory of 3356	4928	chrome.exe	89
PID 4928 wrote to memory of 2564	4928	chrome.exe	90
PID 4928 wrote to memory of 3356	4928	chrome.exe	89
PID 4928 wrote to memory of 2564	4928	chrome.exe	90
PID 4928 wrote to memory of 3828	4928	chrome.exe	93
PID 4928 wrote to memory of 3828	4928	chrome.exe	93
PID 4928 wrote to memory of 3436	4928	chrome.exe	94
PID 4928 wrote to memory of 3436	4928	chrome.exe	94
PID 4928 wrote to memory of 4596	4928	chrome.exe	95
PID 4928 wrote to memory of 4596	4928	chrome.exe	95
PID 4928 wrote to memory of 864	4928	chrome.exe	96
PID 4928 wrote to memory of 2440	4928	chrome.exe	97
PID 4928 wrote to memory of 2440	4928	chrome.exe	97

C:\Users\Admin\AppData\Local\Temp\MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe
"C:\Users\Admin\AppData\Local\Temp\MALWARE Grand Theft Auto VI (cyberleek) build 0.5.2.exe"
1⤵
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:4700

C:\Windows\system32\launchtm.exe
launchtm.exe /2
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\System32\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe" /2
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff721dc728,0x7fff721dc734,0x7fff721dc740
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,1914681049831555862,536012587359394460,262144 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,10079940200984560443,635229436406338963,524288 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,4035209411292580986,3428921408929137127,524288 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,9678523507014586448,1201725016741038257,2097152 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,17659716484873202934,14122157905822577298,2097152 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4460,i,5546230832384741703,16596968691265826865,2097152 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4764,i,5803348576543072971,8579260314122996725,2097152 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4720 /prefetch:9
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4800,i,1938378688471572091,16821269463995993261,2097152 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,11515672590660184633,2530625787482896720,524288 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5324,i,8617589758399941429,6528923467306982284,2097152 --field-trial-handle=1968,i,165857197615115357,6794338940031437919,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f18dbd0-ebe5-4c7f-9c31-eac7a7d5db93.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0f18dbd0-ebe5-4c7f-9c31-eac7a7d5db93.tmp
Size 270KB
SHA256 ac9032900ef20c4b2f7c6cc2484798d7501908ea797dc9b57a2ca9708adb4cb9
MD5 ac9d77fbf0eb289788045494b7f31156
SHA1 fed92d12e4ac2fdb19ae80de678bf9ed957c9c9a
SHA512 5e850b7085e875751ed73f2cc1ef46b78d9463f3aebf0eaa91d63fa86ab6c4e74b26ad03c394c9393ccb5e8dc0794cb4e56eb6a7381861ecf050b7034c5221f3
SSDEEP 6144:t3fYHZV9EONkgDLrKQ6087qtBzpiBJxmX/B5UgKf2ne1utLA:BwHr9EONBPDxztBzp8rOw2npLA
TLSH
T15A44237ADCDF9FF363C46025509CA70E56B56FD780A6CE44807132CE508A6B9439BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

552d4946-0bb2-4749-bfef-687f5c128ee9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\552d4946-0bb2-4749-bfef-687f5c128ee9.tmp
Size 130KB
SHA256 8e5d6581a580dac19b5074ef0d81655a0cdc2af7a5027026e9b7fb636814816f
MD5 fb9463b2b26eed6ef58bdc5b51e34312
SHA1 50849566b6b02a6977bbaa71ac035b0a414244fe
SHA512 0391c28aca998b39862636fb9d32cc63169ba48f159552378d2e6b6d97cbde0d773a5aaf2b288ad737dd7a5960178611db0161ada434f73489bdba900f98c6df
SSDEEP 3072:OhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:OxmX/B5UgKf2ne1utL1
TLSH
T19DD302BE9CDDDFE36361B026B9A95B6EC9F67FC8A160DA4080F41085009F1BD4399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

931ffe3d-6db3-42c2-98ee-3f3673372b4d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\931ffe3d-6db3-42c2-98ee-3f3673372b4d.tmp
Size 270KB
SHA256 92db65122c06dff5b3fb6a4ada006a12168b039e7760365c3691e84918ac45b3
MD5 63b446bf2a2fd85e9ce26c3204bff070
SHA1 7d224376e69db9907ba736b7c40cde64b08b6797
SHA512 703d0d60f3a7f0178fd0d1b86884989398c313f1259de2fc6fa63be79f15436a02fab57c449ad5c242152b52b65332bf29c1e963b0b797408c792aa3274b4768
SSDEEP 6144:A3fYHZV9EONkgDLrKQ6087qtBzpiBJxmX/B5UgKf2ne1utLA:EwHr9EONBPDxztBzp8rOw2npLA
TLSH
T1F044237AECDF9FF363C46026509DA70E56B56FD780A6CE44807132CE508A6B9439BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 7c6e2ff2cdb09e3d8d75fdb570270093f07e5e0a43f0e61e4fb2778ae54aada0
MD5 9a55c891d32d99029a871b7231664647
SHA1 0a7ff2067c1292bce3cf69e91bbbda26dc4c0914
SHA512 2293d8dcdd27570365aaf77fbb1762154f8de366d55bf8d4e8f69cec850d94e4067f4f80f018d02279ad49ea03ce6d1e9bbd226cb423dca66bd9a7c6b142c2ed
MD5 SHA1 SHA512

Submit Download

1cd48341-3365-464d-924c-af1e9477be89.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1cd48341-3365-464d-924c-af1e9477be89.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

781b590c-dfdb-40dd-8380-5bffb58a5154.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\781b590c-dfdb-40dd-8380-5bffb58a5154.tmp
Size 414B
SHA256 65cab2bbd66530bba6139c5b1a1d38c72ef1cfcd1ac2801f01fb387aaec41e15
MD5 15b3bf09ef52b36b32e17bc2650b297a
SHA1 b22f905f1e81264f44f839b06ba2f06adac601d3
SHA512 4016a773d0e7664f0a7b35fbb1897f6af8f9ca4469b68ff2fdd1f93253cb42656112fd924619646c2f6768ce81bae0c71c87fd8d0e2ff8e91b16273fd7f2929f
TLSH
T1E1E02BADC821EC2719FC0F699114A706E74123562B51895F373DC10C4FB16374686D5C
MD5 SHA1 SHA512 TLSH

Submit Download

78498d2f-3664-41ee-b107-3dc0ea2ff385.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\78498d2f-3664-41ee-b107-3dc0ea2ff385.tmp
Size 12KB
SHA256 adc4befa9111154518ee03812f9f26b3ca75b38f43aa0a6cdadf129088c986a0
MD5 63d5dd3a62f94b15659ded1fddb162e1
SHA1 fd59b7fa5e597e0d75ac9080f5cc852247ae5e1d
SHA512 bc6a8a4b419422252bacafbdf721e0ff09819d3a41f62217e0710ede3124f3d8d1fa6ecb93a971058a88b822962f8571787be88b56a40258c598008851690c75
SSDEEP 192:EREosDDv7+7pAPRp26XcQ9ZHsb+WNKEYGM4nLp2z1tKkwkabrVyIsnAUgtaJ:EREo87S7UX3bwEd4N2LKEah8
TLSH
T1B442A42AFD20793B4DEAD32AF921771BE6F5103221952E84E6FC8D2C15D76CD212B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 53KB
SHA256 351ba345250baf98ce325b4017ac9b96c9498f6644937ef558dc5993af676f2a
MD5 1e2d4737305eea41ee9198e3fd3f59c2
SHA1 abff05d701173ab7eae355be60ad30cf7f63536b
SHA512 469723131222dec7ea745b528fe62586da62d02505b6904a4b97157259dd37c26bf0d7012538ec6ab999c4a82d44f97ad7a1bc526cea9e8ee1cd30ff218fbce8
SSDEEP 768:aE9HsQuRLPPTiTRi06pYSINz9AdaTV7n5qAsVUdRwRuIDzjYTXqq2emOr8d/cNPk:aE9HsHPPR06bIhedCaAb+u2veJ8KNad
TLSH
T1354302A0446EF3CA3E6FFD7D9F225D5124E22A354838CAF6103721793F58B959CC1A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 39KB
SHA256 75adde6ac543f716aa255b7f16a1680837383a52b47170fb492b4991a0894fb1
MD5 398110d0224aa55eda480c9dee544c01
SHA1 8377a8da9aee4492a742fbdf1963fcb4c70f81ae
SHA512 4101e2de00f7cac37171616a821bbfe0f8ccc2f2f20772ec0b76a109527f3137013f550fdfd7b6d0ace48a90ad25b2fffc17c8a445b11bb6714d848d306205f3
SSDEEP 768:ICzO/iKGsWBmh3w1sA5J9eJB+PNBlnTS6rTaf8CXUiXS:IC7KJFOsA5reJoPjlnTS6rTaf8CXUYS
TLSH
T12C03022D288E6C94EE73FDE90C7D3639870475E5BB5E44A83999379991D4F009C1630B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 672B
SHA256 95ea38e14703fd69426c742a7d455c0b568b438910c1541a5960f7ec52ba1b34
MD5 7a425d665f65db79f80546a9fe856855
SHA1 f542c6d506407d005b9c84889d48d5e69c2c5166
SHA512 dc364835f5ace334f14c3aed3f9a7d2d7914e60feec805b207dc47fecb389e52aaa0ef52487180e400a3aeee120d119daeb58938f336e3ae8991857a98a979be
TLSH
T1750159D4C89D1019EBB8B131B3755E7728A2064CDFD20EE24123883516333DF4D46B0D
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

0bf3ed01-3257-4e8a-b764-44c48d29d3af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0bf3ed01-3257-4e8a-b764-44c48d29d3af.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

58ab11f3-399b-49b0-b30a-15e5e64290bf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\58ab11f3-399b-49b0-b30a-15e5e64290bf.tmp
Size 1023B
SHA256 d98f04e97ea926c802172382e14ce1118a63cc4118be779214ce04ec9d3300e6
MD5 7cb0612b6ebfb76e144685356a0de5e0
SHA1 b9cd9c0376e275cae2d3f6305d2d12258bc7a06a
SHA512 cd059e446f514bf1b46c079618687f469f2321741e731a3f5985df4797479cce623fb331052e07784b9cf3e2d48a39f8f62ba06e6dc668b33041b1c9f436f261
TLSH
T1E4117BA7EA7EB467106D487B1D04B8262A76B431065124E4CF6B43AE71C09F33F12823
MD5 SHA1 SHA512 TLSH

Submit Download

854dd05d-33ea-4789-acdb-c209f6eb77ba.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\854dd05d-33ea-4789-acdb-c209f6eb77ba.tmp
Size 7KB
SHA256 97e0168daca67e78a02fb1f2f5ad3bbc9b623e42b88b521f1b8f4ae0d6364e07
MD5 ac37c2fbb528d9ac6df69ce7f20d0617
SHA1 d1ea8bfc622c43e1733e3b2c78f52eacd451d5f6
SHA512 f3415d0eba49f2e72121249dbc8b84b85667a30c0808e7816beca557b0b1bfa2e02d048592018683b22f62e536c1af695adb0b0ddf2944a22622abc85bfda43b
SSDEEP 192:DxOg1xohBBtMALaIu3s3K3z21mOFYDvjklT+Z:DxOg1xohBBtMALaIu3s3K3z21mOFYDvX
TLSH
T191F18BF7C7D8816D891156F49B11BF2ECE2A1A18432C3C27C8D8AE5B93F2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 cbcfbe27999bbf1c38c32cf734dbc58c0c74e8fb94cebfe52fc4ac99ec4b2c4e
MD5 2687abbcac7af17c0b616b501e486b1d
SHA1 baf57c5410325446dd74e61be138853be50fcccc
SHA512 d6063c76c0f9513dcd556327052394a8fbae929daff68178795f4017c88a3a038bc8b09526fadfd4132488a9d51a09e3cd9ab6243430667f2c455f48c796d43f
SSDEEP 384:3hjb67KxkXqKf/pUZNCgVLH2HfgslxwXODb++ErU3l6HGjOoAWI8n:3hb67KxkXqKf/pUZNCgVLH2HfgsP6OPJ
TLSH
T19152F867A84D9A7F0FD8C94DD8266F4FACB5015766680C6893FB5C0803E5BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4060-36-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-38-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-37-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-40-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-39-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-34-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-28-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-29-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-30-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download

memory/4060-35-0x000001BC8A780000-0x000001BC8A781000-memory.dmp

Download