7c43cca0811ff5d6f7a8336b63627bd5dc239bae46ba6d4f22ac92d751bc7a5f

Analysis

user interaction
yes
max time kernel
69s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
onyx.exe
Size 452KB
Sample261102-rmffhaaw91
SHA256 7c43cca0811ff5d6f7a8336b63627bd5dc239bae46ba6d4f22ac92d751bc7a5f
MD5 2a4fc5263ecf8c8ef12c35f86117b3b1
SHA1 1166de22d48acb88276a65206e12de49474c54d5
SHA512 e4afd724534f7fa0963c899dac335087cc150a9c79501694f3e9f82586f428b34de56369a218bdb0a7ea9b6d02fbc6e0605ef53c8972460b873829c4db9f6d45
SSDEEP 12288:iSMXDIURteKn5OL5WmXBa5q94OPHWhHx5nudTkOf8Z0ZcvSYd6Q6CFJgP8:9FU9n5OLfXBa56P2PhIU
TLSH
T171A47C15E6E401FDE277D278C9539806EA76784A0730AADF03D095B61F276D48F3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	onyx.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	onyx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2796	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{F5305B50-E772-4478-B098-F783FAD3FD74}	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	chrome.exe
5968	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
912	onyx.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 3768	5968	chrome.exe	97
PID 5968 wrote to memory of 5684	5968	chrome.exe	99
PID 5968 wrote to memory of 2796	5968	chrome.exe	98
PID 5968 wrote to memory of 5684	5968	chrome.exe	99
PID 5968 wrote to memory of 5500	5968	chrome.exe	100
PID 5968 wrote to memory of 5500	5968	chrome.exe	100
PID 5968 wrote to memory of 2136	5968	chrome.exe	101
PID 5968 wrote to memory of 6040	5968	chrome.exe	102
PID 5968 wrote to memory of 2136	5968	chrome.exe	101
PID 5968 wrote to memory of 6040	5968	chrome.exe	102
PID 5968 wrote to memory of 2056	5968	chrome.exe	103
PID 5968 wrote to memory of 2056	5968	chrome.exe	103
PID 5968 wrote to memory of 5880	5968	chrome.exe	105
PID 5968 wrote to memory of 5880	5968	chrome.exe	105
PID 5968 wrote to memory of 5532	5968	chrome.exe	107
PID 5968 wrote to memory of 4240	5968	chrome.exe	109
PID 5968 wrote to memory of 4240	5968	chrome.exe	109
PID 5968 wrote to memory of 4664	5968	chrome.exe	110
PID 5968 wrote to memory of 4664	5968	chrome.exe	110
PID 5968 wrote to memory of 804	5968	chrome.exe	113
PID 5968 wrote to memory of 804	5968	chrome.exe	113
PID 5968 wrote to memory of 5252	5968	chrome.exe	115
PID 5968 wrote to memory of 2800	5968	chrome.exe	116
PID 5968 wrote to memory of 2800	5968	chrome.exe	116
PID 5968 wrote to memory of 5208	5968	chrome.exe	117
PID 5968 wrote to memory of 3892	5968	chrome.exe	118
PID 5968 wrote to memory of 4632	5968	chrome.exe	119

C:\Users\Admin\AppData\Local\Temp\onyx.exe
"C:\Users\Admin\AppData\Local\Temp\onyx.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of SetWindowsHookEx
PID:912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff91b75c728,0x7ff91b75c734,0x7ff91b75c740
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,7418964063324728757,1402094876015913044,524288 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,5527788826172279691,11101197712831878784,262144 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,10513374015851838130,5441244906168884651,524288 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,5155920430772424758,10879306195097647550,2097152 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,5162074157862218095,16168521722425868837,2097152 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3956,i,2080641716554654475,16138833377475381896,2097152 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,11265503133557301500,2961438325405357087,2097152 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,1807034371380220850,3065346892887780627,524288 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5844,i,8318702066755708959,1691274177936377347,2097152 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4892,i,5494944907519310745,6415421471612179467,2097152 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5912,i,7282182433174385905,1572759225532875783,2097152 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,7984119583157371384,11958091034568428723,524288 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,7635086146982750632,12089093941547218261,524288 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,6844484148084852482,572658265045856891,524288 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6060,i,15325228845583957140,8715808859860281811,524288 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,3339434611512745456,9422281012606250318,524288 --field-trial-handle=2128,i,10205207356946362459,4448230836823046194,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:4632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

286235fd-7672-4aed-8c1e-3a8d4110ef47.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\286235fd-7672-4aed-8c1e-3a8d4110ef47.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

62590110-f546-4364-b63e-a0df6ac2cc06.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\62590110-f546-4364-b63e-a0df6ac2cc06.tmp
Size 13KB
SHA256 8ea281a5f8922b5cd4db300e6b0437277acb4f20b5d8f085050e3192d7a05a3e
MD5 76a4de8fdcdf7f1b32088de13725764f
SHA1 075dbb9eea6af4bbee8d8d1abf8b6f36a17fb25b
SHA512 e47a9321ed37129b81b8b91d10bb7cc3782ef8d0123b8cea9b25242898ea4034effba93be835cb6668446661dc4287d5c2c11890460432f25b35a70f38515d50
SSDEEP 192:0REmq+DnGNPmWv7IpAPRpVRA96Hsb+WNncz49toeeTp2TgaRIYkVyIsnAUgcaJ:0REmq+D0miEUXkswRHeN2Ua05
TLSH
T16452A52ABD10393B6CDBD329ED16771BE7F6102524842E84EAF88D3C25E75CD221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c6bd586-2c58-4117-a1ee-95ede875ff13.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6c6bd586-2c58-4117-a1ee-95ede875ff13.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a279af7-6812-4f7f-8ab0-f715b01a24ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8a279af7-6812-4f7f-8ab0-f715b01a24ec.tmp
Size 414B
SHA256 6e0e50f763b2a41d43f163e2edb2720019fddef76b95fe39672dcde52b344935
MD5 fc40abf3d370c3ee66653745f692664c
SHA1 cc59aa69c21c2767134ff76a84d1d611833eaa36
SHA512 99e4130d42f26b443e4653a828cfdb9935396c81a27192a4ed21386f67d0d160e1493866926300a30865ddb4f8703c162ed4a4b347a1fc231fc85116766513ed
TLSH
T177E0E5FAC925B82718FD1B2D55508F8BEA5A17662680844B7A3C450A8FB5A3602C581C
MD5 SHA1 SHA512 TLSH

Submit Download

96e6697e-f5f5-48e6-b688-5ab13e528d3a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\96e6697e-f5f5-48e6-b688-5ab13e528d3a.tmp
Size 12KB
SHA256 15e312d789cc877ed872eac7911ea9ba1847d0e19523dca3abaa6640ed035a83
MD5 ccc11ff4fe292957b063dc000e5d1451
SHA1 0c28465a05aea7c384b66d83a8c48fca023d90d8
SHA512 001b89fd73f250a9980dac6250dd9c033d87fcfd1a7602cb4be00c2e5a7aa9dafd4cba63447de9f59c4d84cbc2cf987375454258318f029a7b76af2c2d9472b7
SSDEEP 192:0REt+DnGNPmWv7GpAPRp2RA96Hsb+WNncz49tLB2Qp2TgaRIY5VyIsnAUgtaJ:0REt+D0miCUXXswRb242Uaz8
TLSH
T15142952EBD10393B6CDBD32AED16771BD7F6102524942E84EAF8893C25E75CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

04fae9c1-f1ea-48fb-a86f-71a0287531de.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\04fae9c1-f1ea-48fb-a86f-71a0287531de.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 dc192593803ed2e9edd7a44f0d4e99edce8b6cb4742d5c2ba718b9dd8c481232
MD5 ca2658af865aeb03cbf02640f550d35e
SHA1 056fd2899b1b60a5e3d375d6f9fe0743d2aa7799
SHA512 7d976a5ee2ded5dab45b09b14d5c118debad67c859e6905f8dcbf9306d72ac35cab31d5aecb3552c050db3accf9c61004d48fe333bda2e00465831d6c9b7d7f5
TLSH
T18FB0120980816741C0020370125190A432608F34D65713D5D1E00D168832171851B129
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 aafff1f23493b5db7f9242927d67b0482f978abfba85be178448bd37dd42a9b4
MD5 ece0a6f7b056ab0e9509e4d3ef5a602a
SHA1 4c4863ae6222dd15449838d5bc099b848d9f29b0
SHA512 a647be493bfe0409c6b402e53ee38b45603ca79e0a6b5a35f7ff8ea6a5e4ba26326da7df664c732edcbe0d6bcf4b2de01090788e901a41fe8c87f16cb6662b2f
TLSH
T18BB02220C0022203C00203B020A882E83020CF20C203C33282E00A32CC22EB0CE3A020
MD5 SHA1 SHA512 TLSH

Submit Download

aeec5c00-06b2-4cd9-936d-bd2d6b9a28dc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\aeec5c00-06b2-4cd9-936d-bd2d6b9a28dc.tmp
Size 130KB
SHA256 0ae7f9279c1006cd0eaac9d42ac508f16f9e6dc2e055fe9a5bab57fef3cf14b2
MD5 273e11bcf4c798293f79df247f0b3489
SHA1 73d97412ef59fb98a9888c93c7470f9c22104798
SHA512 a62e47846b151769f02f07edee8f1896c97e3e7643b24f1d6b04e95093ecf07d609465535e16df791cdae98d3347e491dde88d9db23743b9027a0aa2cf1da3f7
SSDEEP 3072:Us+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Us+hFD+7t56OD9ZfSApprB
TLSH
T1BCD31232AA91D8BBC9BC6141B157A300CE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0c197df-2101-4a1e-a05b-1ca8369666c0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b0c197df-2101-4a1e-a05b-1ca8369666c0.tmp
Size 269KB
SHA256 4fa3a0a4a64fca874ecfc6d7d0a33cc1c3003b2747ce08702f331b114af5f453
MD5 fd86f4496c7ba38ec686576f1e6c3eb8
SHA1 55e5d5c0caea82b3f30285a0b2536c8be3fbe5c6
SHA512 c940b039d4633fdc7e94ec3cc8060c491c590d5c3b79ae81bebad8350ceec13d6fc55a708196d3fabe809aeaf8c9e0b936e03f108151e5db38c2e8e6e30b9713
SSDEEP 6144:9BvHWe40m3otUf+8Wp53EX9pxsNTF+hFD+7t56OD9ZfSAppra:x493obX3ETxsryFSXD9ZfS4s
TLSH
T1394422258EC59C7BCDFC5187750BF7059E788DDA929A9A0108A12F4F711FC9E06B3632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download