Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 19:17
Behavioral task
behavioral1
Sample
897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe
- Size 55KB
- Sample261030-xzebvsfd39
- SHA256 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a
- MD5 2c1187bb99ed21458e686f5933f459c5
- SHA1 6957f43f200adb3d232676a7ee24cf68f3b4d1bf
- SHA512 7661fb75efb5d1c768fe90002014a71ca5dc138afd439826536ae860be5116099d57434b9b67195bc29fe3a05dbacaaca58ea83fa45ae97fe4418a0de6681bf1
- SSDEEP 1536:R1UMsDnKNgpynpGSDLwsNMD+MXExI3pmBm:RsDn1on4SDLwsNMDPXExI3pm
- TLSH T1FC431844BFEA4A05E2BD8F3468F645150634BA63E532EB1F48D568EB17327C58C80FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\af3d34a81e83d07547e0e740886b217a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe\" .." 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\af3d34a81e83d07547e0e740886b217a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe\" .." 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1236 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3656 chrome.exe 3656 chrome.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: 33 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeIncBasePriorityPrivilege 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: 33 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeIncBasePriorityPrivilege 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: 33 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeIncBasePriorityPrivilege 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: 33 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeIncBasePriorityPrivilege 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: 33 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeIncBasePriorityPrivilege 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: 33 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeIncBasePriorityPrivilege 4680 897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe Token: SeCreatePagefilePrivilege 3656 chrome.exe Token: SeShutdownPrivilege 3656 chrome.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe 3656 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3656 wrote to memory of 4068 3656 chrome.exe 100 PID 3656 wrote to memory of 4908 3656 chrome.exe 102 PID 3656 wrote to memory of 1236 3656 chrome.exe 103 PID 3656 wrote to memory of 4908 3656 chrome.exe 102 PID 3656 wrote to memory of 1296 3656 chrome.exe 105 PID 3656 wrote to memory of 1296 3656 chrome.exe 105 PID 3656 wrote to memory of 2704 3656 chrome.exe 106 PID 3656 wrote to memory of 2704 3656 chrome.exe 106 PID 3656 wrote to memory of 4204 3656 chrome.exe 107 PID 3656 wrote to memory of 4204 3656 chrome.exe 107 PID 3656 wrote to memory of 1132 3656 chrome.exe 108 PID 3656 wrote to memory of 1132 3656 chrome.exe 108 PID 3656 wrote to memory of 1836 3656 chrome.exe 109 PID 3656 wrote to memory of 1836 3656 chrome.exe 109 PID 3656 wrote to memory of 4212 3656 chrome.exe 111 PID 3656 wrote to memory of 5420 3656 chrome.exe 113 PID 3656 wrote to memory of 5420 3656 chrome.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe"C:\Users\Admin\AppData\Local\Temp\897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
C:\Users\Admin\AppData\Local\Temp\897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe"C:\Users\Admin\AppData\Local\Temp\897694f639569262598ba00851028184fe533edd3d28da8677afd745e283244a.exe" ..1⤵
- System Location Discovery: System Language Discovery
PID:5288
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd20c1c728,0x7ffd20c1c734,0x7ffd20c1c7402⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,4392896066277829607,9913905608000393344,262144 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2012 /prefetch:22⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,5676747733460120657,17728795348895046782,524288 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2116 /prefetch:32⤵
- System Time Discovery
PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,17894861855915634165,13533033937703201337,524288 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2600 /prefetch:82⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,2173368116700905400,13607209365689307715,2097152 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,1164657270831278832,4861599203377409778,2097152 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4492,i,13317077000789254393,4707007706305479442,2097152 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4508 /prefetch:22⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,693335274802800453,13763463180396518638,2097152 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4656 /prefetch:12⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,16600770046327806958,1293816177735456055,524288 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5968,i,471183541152802072,4753733473725418014,2097152 --field-trial-handle=2024,i,17881705963538668285,15843549291454839621,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:12⤵PID:5420
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3524
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
- Size 40B
- SHA256 baee53444a53ae41439e5e4e8c3120eb246a04a4deef889942c0c6f656892b12
- MD5 32286766ad60cf3d61e573f4a168f40e
- SHA1 babf005236a49aebd6c7c2078707c3f490530622
- SHA512 cfab2277ad8198039e2df65223f7f027a0143cf782fb5f72d2c7498f21705b5201effc182998a603fedebb6e99174a63e99349d78588816e051dfeb3becd57ba
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\52f2876c-85a0-47bf-9478-5a66652b08a4.tmp
- Size 414B
- SHA256 d71c970c6cbf5efd10e1b9f911943a9334f78a555db03a76e0666eaed968c123
- MD5 92c89cbc8aa8f72fc2fe86453e483801
- SHA1 48ee2392459bcc9b402a88900b7ba5833f5eb5af
- SHA512 9461f417803594c6510bfab71ec5c448651137cf1c09e158064fa350562a198ed780ba57af5a0c95f186a24c0588f945cc38c4d331ec21324d227a7760d96a41
- TLSH T19EE02BA6D8119C376DFE076921918645EB54236B2B40494B363CD01C8FB113A86D9D5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\94a2722f-d8c9-4469-bbf7-8afd221073ea.tmp
- Size 13KB
- SHA256 f665d98420762ab5f8172b243e4dcf9a0802fde37ab2ff7b9e8bb64a8f83566c
- MD5 62c4829f7cbadbf7a17f98fa3e2499df
- SHA1 357584a26f54b74de0ab2b5441416df0f7f24cfd
- SHA512 f70a5a55908c310fbac651854cf9e46c65786c6ebf81e2cb7fec8dbb379ad6f736dcd7f07ec777c7d4cfd13963d03d9f938a2b1aa336f36547a6c9a692708250
- SSDEEP 192:gRPp+BYHPjlDBv78IAPRp2Ymh9THsb+WNnESrXN2eQek215gkwVYtlVyIsnAUgtK:gRPpMuR4JX0JwN52eQ3215gG8
- TLSH T1A552B32AED10793B5CDBC22AF961B727D7F9102620D41E84AAFC8D7C25E79CC621741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
- Size 346KB
- SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
- MD5 cffe89fe76f974f10f591767becdc8ea
- SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
- SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
- SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
- TLSH T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 144B
- SHA256 d5f2e5df4899bac7b35ce5ddf11158a139a623485da908f7a006bc340b668e75
- MD5 55813c54f96f7c971e62d80873ee80c4
- SHA1 8e329a047c3916e62d665f663aa120b80cb1f826
- SHA512 9a2061743f82a34b36afeb24a2bdc0fe4e727234e35c104184fef7bd6eeb9dfaa6fec95377eb7471b69b14b7516400974ac91b28c8c12c790c21dc1b606fa88e
- TLSH T12BC09284A694A988EB2921F1AFD9845025A00EAA40A26292539145B85733EE581409C1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\981f1d34-cf0a-46f3-96b2-1c5b46cc941e.tmp
- Size 3KB
- SHA256 7931172077792a5219106f5e5b6ef136cdded1d1921db6e460ca5b16c538fe4e
- MD5 733f619a1a111e240d68099349c8fade
- SHA1 0fbcc616161bd3a0981ca32e93e34012a7c69a8b
- SHA512 8d3b44a1e4a50e1265273116e73b982805c91215145ffca7e4807cb490ba1b26ccaebb1fb50e0d0750de3949225ec23d2585a42bb92f28f61fc6e24305feed90
- TLSH T12D719FB7C3D8C66D894156F4AB256F1FCE2D0A28431C3D66C8E4AE5B53F2972D21034E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\eab338af-d9e2-4fd8-b255-e2ff4528d3fe.tmp
- Size 523B
- SHA256 3d8f04b4e48bf4ec72d2d1c10085f4c30729643f1d369420bd8ee09417e06721
- MD5 ccb66961138dcd845c82944134403f6f
- SHA1 8a69a0c6ce4a4a2ef77527eb41c938aaeee1b763
- SHA512 3fac9190ebfb0f6714352b7cf722f11c8672efc95ffd1424fc36a8f9d0e0656882b42618b8af3d48d2b608447391033687e93acbb0b1ce4ad0ac1099fa3827cf
- TLSH T13DF09EFBBB79747710BB84B71D0178052AB6B434024264F4DF6B426DE0DA9FB0B02453
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fab20a55-c2e5-4fd0-86ab-ccdf2e683bb9.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 3d979bda9c1014df7040a1a74fcf0f3bab10c917be836e3aa3ba62679d037c6e
- MD5 909ea35a5d45a7725ba0527e9786f318
- SHA1 6cfffd5c4ec1a1da778869ddbafd6806746fd729
- SHA512 e7d4bd6636c581a7bfdbd03658c9ec3bc50ddc1f2fffe0e132be155ea399b46d0e9974063fa58e45e31c3976e14c16539aa01e387827d5bf6a1f88b957e56ff4
- TLSH T17FB0120680C1B356C00503742650A05472F0CF34D21313C942E01D568C32170811711C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 3f6d5c43831b3e30b60f7f4d75fd13fd96512172f4b70cdc793772cafcf31034
- MD5 3622a414e78ea032d3da945834afd410
- SHA1 8c964f7fc67d182d1e326b1f6b4785ad071487cd
- SHA512 494f1548f5172f2cb87df61a6f96ff4cb3267ad5e628f1f1747ccd4b948d0fdbc6e6186a854bafa64c576dad0558db3d8647c21206213eaf79206051f42a0aed
- TLSH T1DDB0222EC002A202C00203B0B28280C83032CF20EA030232A2E80E32CC2223008200A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b65ff8dc-4672-40e6-a790-bf2919f261da.tmp
- Size 17KB
- SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
- MD5 c8926c13ed1e541a9ebca052800d518d
- SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
- SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
- SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
- TLSH T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bddb30a3-3ba8-4f61-b066-13c46a445c8b.tmp
- Size 12KB
- SHA256 9292be8d8e5af99f868ee1a986a46076b24ebf745582b90eb0008ffd6ca1163b
- MD5 13ce32e38667f9b3c0f8ad8566e59fc0
- SHA1 7e287872ac5056e39b164be95ad120021bcbe305
- SHA512 db9eef770baffea3cd559ae876e0aba5252e00d8cb4c77d7a351fc25a29ed73576b20a750b29d93f66a825b4e6d1c401e956ed475f9840566104db807cc61690
- SSDEEP 192:gRPp+BYHPjloBv78hAPRp2b9THsb+WNnv90eoek215gkwVYtlVyIsnAUgtaJ:gRPpM1R48XwJw10eo3215gG8
- TLSH T1BB42B329ED10793B5CDBD22AF9617A27DBF9102120D41E84EAFC897C25E79CC622711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eb0fe7ea-64af-4ce8-a98e-49afe0c81dbf.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a2476aa6-b16b-42e5-b207-5633378876e2.tmp
- Size 130KB
- SHA256 0af9185dfdd476753ad12a50d4b82020da501f5dbee80fc8159f072e1c5edf97
- MD5 11c19805ca9fd104f8caa001ab184336
- SHA1 2ac922d4448484f5f22a7f221538d19f30c80adc
- SHA512 09733ce146d134ab9dc4f6e4550f8251114d12e6fd800173b4a3e85338aca4ba2be869cd0f59ad87a315c20e58a92e85eddc8e160711ff58316f1ebe094565fc
- SSDEEP 3072:++lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:++hFD+7t56OD9ZfSAppry
- TLSH T1F9D31232AA91C8BBC9BC6541B297A304DE766CED41DE3A09444A5F8EE05FD4C0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a9526b08-46b8-480b-94e2-5f825de927b9.tmp
- Size 270KB
- SHA256 5c8300eeddd79efbcf95380bd9ff85d6fbd141a18569994b44d8a9dc443efb04
- MD5 c2d9a5bbcb59344831f2bcbac7cd7512
- SHA1 996db0ae927ffaea117f45affeaacc6bc2be8e1a
- SHA512 2bcd55018ffd1af66dcc3663d33deb8ac4d047b188d2712527c3dd87bde88ed59d8d08c233d2a96687f27faeed5ca219b8d00bf6727c5be4399225132d3378a0
- SSDEEP 6144:EtcrmBfzOLTewWLnIQNwkTE3f+hFD+7t56OD9ZfSApprW:EtcQrOLTewywyFSXD9ZfS4M
- TLSH T179442339ABE68CFFC6F84A01701271198EA55CC9048E3FCA45895F86B15F95C07E3AB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c628c755-2c5d-40a8-ba2a-f39a7027cd8b.tmp
- Size 270KB
- SHA256 8ab7037166839278f20664824c7329419f57ddd14a119a5c36054b6d2f8bda40
- MD5 e263295cc9aec87a07d3425d9b1955b5
- SHA1 a2dfddb5bc988208b10e4797e949968559c9bcf9
- SHA512 f994454529a6f03c8f573741221e9c152e46b62adec66f5c510098a4b23139d259a4eadb9a7ef7f22eca634d1f5630f2e00c0e846d8993b38d49a684584eeff7
- SSDEEP 6144:KtcrmBfzOLTewWLnIQNwkTE3f+hFD+7t56OD9ZfSApprW:KtcQrOLTewywyFSXD9ZfS4M
- TLSH T1F8442339ABE68CFFC6F84A01701271198EA55CC9048E3FCA45895F86B15F95C07E3AB7
- MD5 SHA1 SHA512 SSDEEP TLSH