Overview
overview
8Static
static
3SlenderSetup.exe
windows10-ltsc_2021-x64
8$PLUGINSDI...er.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ll.dll
windows10-ltsc_2021-x64
3LICENSES.c...m.html
windows10-ltsc_2021-x64
4SaveSetup.exe
windows10-ltsc_2021-x64
8d3dcompiler_47.dll
windows10-ltsc_2021-x64
1ffmpeg.dll
windows10-ltsc_2021-x64
1libEGL.dll
windows10-ltsc_2021-x64
1libGLESv2.dll
windows10-ltsc_2021-x64
1resources/...dex.js
windows10-ltsc_2021-x64
3resources/...pi.dll
windows10-ltsc_2021-x64
1resources/...e3.dll
windows10-ltsc_2021-x64
1resources/...act.js
windows10-ltsc_2021-x64
3sqlite-aut...llback
windows10-ltsc_2021-x64
3sqlite-aut...ace.js
windows10-ltsc_2021-x64
3sqlite-aut...al.ps1
windows10-ltsc_2021-x64
3resources/...ing.js
windows10-ltsc_2021-x64
3resources/...te3.js
windows10-ltsc_2021-x64
3resources/...ace.js
windows10-ltsc_2021-x64
3resources/...kup.js
windows10-ltsc_2021-x64
3resources/elevate.exe
windows10-ltsc_2021-x64
3vk_swiftshader.dll
windows10-ltsc_2021-x64
1vulkan-1.dll
windows10-ltsc_2021-x64
1$PLUGINSDI...ec.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...7z.dll
windows10-ltsc_2021-x64
3$R0/Uninst...up.exe
windows10-ltsc_2021-x64
7$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ll.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ec.dll
windows10-ltsc_2021-x64
3Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
28/03/2025, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
SlenderSetup.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral7
Sample
SaveSetup.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral8
Sample
d3dcompiler_47.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral9
Sample
ffmpeg.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral10
Sample
libEGL.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral11
Sample
libGLESv2.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral12
Sample
resources/app.asar.unpacked/node_modules/ilovingcats/dist/index.js
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral13
Sample
resources/app.asar.unpacked/node_modules/ilovingcats/prebuilds/win32-x64/node.napi.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral14
Sample
resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral15
Sample
resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral16
Sample
sqlite-autoconf-3440200/Makefile.fallback
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral17
Sample
sqlite-autoconf-3440200/Replace.js
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral18
Sample
sqlite-autoconf-3440200/aclocal.ps1
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/sqlite3/src/backup.js
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral28
Sample
$R0/Uninstall SaveSetup.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
General
-
Target
LICENSES.chromium.html
-
Size
8.8MB
-
MD5
2675b30d524b6c79b6cee41af86fc619
-
SHA1
407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
-
SHA256
6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
-
SHA512
3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
-
SSDEEP
24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876002444949303" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4852 chrome.exe 4852 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4940 chrome.exe 4940 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe Token: SeShutdownPrivilege 4940 chrome.exe Token: SeCreatePagefilePrivilege 4940 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe 4940 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4324 4940 chrome.exe 82 PID 4940 wrote to memory of 4324 4940 chrome.exe 82 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 1888 4940 chrome.exe 83 PID 4940 wrote to memory of 3512 4940 chrome.exe 84 PID 4940 wrote to memory of 3512 4940 chrome.exe 84 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85 PID 4940 wrote to memory of 4300 4940 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb7a6cdcf8,0x7ffb7a6cdd04,0x7ffb7a6cdd102⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1988,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1984 /prefetch:22⤵PID:1888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1592,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1804 /prefetch:32⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2352,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2516 /prefetch:82⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5032,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5044 /prefetch:82⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5052,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5244 /prefetch:82⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5108,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5104,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5268 /prefetch:82⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5208,i,9847529922740005162,13159367692632609399,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5340 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:1116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5f163f24935d785a32653b39107bf7d1f
SHA1052a0a2aaef0f328343e0b901265d40ef12db473
SHA2566f769a2481da13a1ec0517c93cabf6fa40e8a9f491f52135c9f880e6645ac750
SHA51271a33416b2d70583d547b65e971acaa7878fecca3ef77e39ee9940a3e68b03f7f9befd17a06173fef6ffb70fa93b101b47025dd5fe01a8351ce894ca42821f53
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
10KB
MD5e60755342ecb1ddf18b8ad01a911a237
SHA184aa85d35d061e4582db78517003ecb6cc96688f
SHA2569d11daea3381348d80448034460a76cb0eb5b066ba3e34774c95d72f1a802459
SHA51267e9660f16522584f0358a6efc4d146779c84b6232071e42a14cf131cee04db5303e19de71cb50caf260e7fccb94d9cf6e48f856ae556743b4f3cb6e8d37361a
-
Filesize
80KB
MD59c3bfc8cc41e22f25d0aba16f18f5982
SHA18e720e47cbc66f3ff7c879176d2ed9938829a1c5
SHA256e4aa049730c4eb4fd7be041b480817896d773f130fd6e01af06d3b36c0bdcd82
SHA51228af4b119720624135509d3b2b228933f099f254ffe0b5b6dc3f9e4b98896ef00f6403d3b4006e67cda9110ad6136e14c23d2b8a8f24e2d864bfef2ca713494b
-
Filesize
81KB
MD55c6bcbaf16af12ddd77280d80e1caf88
SHA17737d377c4023b38c2cd588797700cd9b407b000
SHA256462ff01ec0a689697f780dc668fa3cf549eeee1798c5483a33ad7f077b495dda
SHA5122e34c74474dae490362c64f8aababe08b462e432dc9a62a8dabe148287c1587cf7418b8fe04cbbc941f63242964f42c3a564d85d7310956a376a9fc0b6d35007
-
Filesize
81KB
MD5a535c813199cfe5d628a5117b41ab7f6
SHA1c81b72edfecd66870b09b425feffaed767dafa95
SHA256b4c4b5b92b4dab9be533e28e421617592b1abd5dc99b106055eac1b63582bad6
SHA512d833ce492da3f52f53f9bac0afc146571aae052c6fee228e2f6388e264c79c09398ad2c6defeb0342f5eb857d2847dc3f42739b8ce6cc62aa63e2a3be76f2274