Overview
overview
10Static
static
3windhawk_setup.exe
windows11-21h2-x64
10$LOCALAPPD...im.dll
windows11-21h2-x64
3$LOCALAPPD...im.dll
windows11-21h2-x64
1$PLUGINSDI...ol.dll
windows11-21h2-x64
3Compiler/i...ing.js
windows11-21h2-x64
3Compiler/x...++.dll
windows11-21h2-x64
1Compiler/x...nd.dll
windows11-21h2-x64
1Compiler/x...im.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
5Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1UI/resourc...dle.js
windows11-21h2-x64
3UI/resourc...b6.svg
windows11-21h2-x64
6UI/resourc...324.js
windows11-21h2-x64
3UI/resourc...b27.js
windows11-21h2-x64
3UI/resourc...892.js
windows11-21h2-x64
3UI/resourc...ain.js
windows11-21h2-x64
3UI/resourc...on.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ain.js
windows11-21h2-x64
3uninstall.exe
windows11-21h2-x64
4windhawk-x...er.exe
windows11-21h2-x64
1windhawk.exe
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
605s - platform
windows11-21h2_x64 - resource
win11-20260130-es - resource tags
arch:x64arch:x86image:win11-20260130-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
windhawk_setup.exe
Resource
win11-20260130-es
windows11-21h2-x64
32 signatures
600 seconds
Behavioral task
behavioral2
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Compiler/include/wil/windowing.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral6
Sample
Compiler/x86_64-w64-mingw32/bin/libc++.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
Compiler/x86_64-w64-mingw32/bin/libunwind.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
Engine/$R1/32/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
Engine/$R1/32/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
Engine/$R1/32/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral12
Sample
Engine/$R1/64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral13
Sample
Engine/$R1/64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
Engine/$R1/64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
Engine/$R1/arm64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
Engine/$R1/arm64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
Engine/$R1/arm64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
UI/resources/app/extensions/clangd/out/bundle.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral19
Sample
UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
Resource
win11-20260130-es
windows11-21h2-x64
13 signatures
600 seconds
Behavioral task
behavioral20
Sample
UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral21
Sample
UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral22
Sample
UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
UI/resources/app/out/vs/code/electron-main/main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral25
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral26
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral27
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral28
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral29
Sample
UI/resources/app/out/vs/workbench/workbench.desktop.main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral30
Sample
uninstall.exe
Resource
win11-20260130-es
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral31
Sample
windhawk-x64-helper.exe
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
windhawk.exe
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
General
- Target UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
- Size 1KB
- Sample260420-jph1eact2k
- SHA256 1b7ccaa82d8497ad2fb85b0ce31eaeb6a5cad46a8b63ec451211c59634dc8193
- MD5 e04963a47c92c5299ee7931f5abd11ad
- SHA1 562dbd07e84b55d1a13ac2d897464cbbef5f75b4
- SHA512 054c724482357e4988b9e42fc56d5f5b2883770e495d3ba5e03810a46504b8743244ccf33f0a293f22628c53ec169a62193f6fb1fc86db9746cdb9a63cb180d1
- TLSH T1B421E31AC2200B74AA4E127C55F449B539C8ECDCE194F6BC689F5011F02CB95A462BDF
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1892 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211450983743328" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 788 chrome.exe 788 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5316 wrote to memory of 4616 5316 chrome.exe 78 PID 5316 wrote to memory of 1892 5316 chrome.exe 79 PID 5316 wrote to memory of 4292 5316 chrome.exe 80 PID 5316 wrote to memory of 4292 5316 chrome.exe 80 PID 5316 wrote to memory of 4236 5316 chrome.exe 82 PID 5316 wrote to memory of 4236 5316 chrome.exe 82 PID 5316 wrote to memory of 2220 5316 chrome.exe 83 PID 5316 wrote to memory of 2220 5316 chrome.exe 83 PID 5316 wrote to memory of 5056 5316 chrome.exe 84 PID 5316 wrote to memory of 5056 5316 chrome.exe 84 PID 5316 wrote to memory of 5656 5316 chrome.exe 86 PID 5316 wrote to memory of 5656 5316 chrome.exe 86 PID 5316 wrote to memory of 1916 5316 chrome.exe 87 PID 5316 wrote to memory of 2720 5316 chrome.exe 89 PID 5316 wrote to memory of 2012 5316 chrome.exe 90 PID 5316 wrote to memory of 5336 5316 chrome.exe 91 PID 5316 wrote to memory of 788 5316 chrome.exe 92 PID 5316 wrote to memory of 3348 5316 chrome.exe 93 PID 5316 wrote to memory of 3348 5316 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\UI\resources\app\extensions\windhawk\webview\logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1c37c728,0x7fff1c37c734,0x7fff1c37c7402⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,6915357611784099937,9911827602754921614,524288 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1992 /prefetch:112⤵
- System Time Discovery
PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,4083006616784652410,5284565474608462182,262144 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1908 /prefetch:22⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,15580185055296016118,12421656424886658666,524288 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2536 /prefetch:132⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,2319038318257013912,18292344907795286656,2097152 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,16393877979259467827,12617645016505166832,2097152 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4264,i,13130461946645338201,12329977353120137529,2097152 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4272 /prefetch:92⤵PID:5656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,766115063874558114,14125496698674940243,524288 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5260 /prefetch:142⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,17572058858346171724,14932942272986207316,524288 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:142⤵PID:2720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,4473294980548344871,15576244959275122998,524288 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:142⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,1626796042103446462,7295713646965040193,524288 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5260 /prefetch:142⤵PID:5336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5464,i,5385002295755860678,4407301404256259364,262144 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5288 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3876,i,8787692101158651051,1501743265643915259,524288 --field-trial-handle=1912,i,18212416964399120931,5185010868564766292,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5288 /prefetch:142⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 0baa0f39c79a026dd42d98f0f54c06218805f3a855cead7c4ddd5dda47136ddd
- MD5 d7d41137224c6b9b09c71787a0ddf87d
- SHA1 f6ec00f724f688ad7e8f3220796f48dd8de7b84b
- SHA512 0cf8f5fbd52bc29149f4b961373bffcae3770a51a658d7059ac5324acbaf3bc15805498cc4705fcbc3fe6c3e53033ecda04476861a0beb97d29a393d54953b85
- TLSH T132E022AEC921DC2B18FD0B1C68510746F748136B2F90898B7A3C82098FB1A3A06D5C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 832a3b3e3b49421a4580ad7c667d26059aa8d6c3d7ac9384cea8c4e784c225e4
- MD5 a21ed85ba1fac635f2c364bbb9756de2
- SHA1 154af023050dfd9e31663e1f5ada575647dad7b4
- SHA512 6b599d91bb2376569e641d500308c58481268cbdc564b4b70353739c4e0a239c03f502d5b8d6790132885cf39a29519dc57a59bc4ff9281636545eb74e0582c9
- TLSH T153419EF793B4997E861192E4DA15AE2FCE790924131C7C62C9D4AE1B43F2973D20178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 dfe6a7a28228bbb3806c58ce830f31d01d35fd98b4528ec3b16b6089b79f3e1c
- MD5 085a139c2263627a4f2e74e59549979d
- SHA1 83f42066896ed9def34b315f1d300ecfedc478fe
- SHA512 f8bb5fc1737392d151add90010a81e34e9bcbdbc1028efba10ec66838c86fff3945159527f422e3c4e6cfd8f03db1391fa7288e511bd515da13650f88716dff3
- TLSH T18551BEF793F4997E8A1196F4EA156E2FCE7D0924131C7C6288D4AE1B53F2972D20078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 cccbb5a599557e4b193c314cfd9e634cd9cafadc20c80e539bd00e579e0bd83a
- MD5 29c6356dcda2813419ef684e8cd78efd
- SHA1 30649ef69cddb4d961919d0f6efc6831f5d5ea6a
- SHA512 e0ea12ebeaf0075bcc0f241b4b75d4e8e79c5f41c53fd128410b4f17750057ac8bb41149da8bff0af0385e610c412092c5aadb984f1a74e1942741fdb09eae5e
- SSDEEP 192:xQRvLfi0f/44Du73v7XpAPRp2uw9BHsb+WNnIVPWdUkwAa0oqR+VyIsnAUge:mRvL5107UXUDw+Pdga22e
- TLSH T16042D82EAE14343B9CCBD21AFD25BB53D7F5102561942EC8EAFC8A2C15D79CD222B417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 8a53a97ada808d53c88f7f209a1e883689276c6e4897259193bc93f0b29e8b27
- MD5 ab4ed426801be234d3442f7d077e6204
- SHA1 33d65aedeb2cc608f9b4cfc435271ca6d61d264a
- SHA512 69b1dea0ececf40cadeef084d57587181403f9d111854b84d677dc0406124fcb2d0f31f829888c123308f816aa20cbfee272fc5399cd3c4f9b0d8852984730d7
- SSDEEP 192:xQRvLni0f/44Du73v7XpRPRpNuw9BHsb+WNnIVPJdUkwAa0okR+VyIsnAUgE:mRvLh107nX5Dw+P0ga02E
- TLSH T1AF52C72EAE1424379CCBD61AFD25BB53D7F5102561942EC8EBFC8A2C15D7ACD2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 797a66035ebf115e19a5c852a83575a3420ad1174c539bdb1d6a15141e38be5d
- MD5 09b2266a27756bedb97ee23174baf8ee
- SHA1 d10af69229e909eb16528e586aa902eef36c8c57
- SHA512 d537085d84fe3a777bf416296b5a4eb52280d380597629a157a7e11eba6f6a7e3cca2f20a2b02b338d21b66514cc8e1c80efc300f46d7afb30defc2d7de663b1
- SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLILcmfa7XOD0z+ErU3W3H1WTStAAW:460v7KxkXqKf/pUZNCgVLH2HfgsyX7pm
- TLSH T16F72F867AC4C9A770F94C68DD827BA4FADB5014B64D9886443FB581903C5ACB150A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 30ebcef68af8dd84c8504767eec2c38a34a9e456c5920f7428e3fa537d312159
- MD5 ab2293d2e5fce60734b08f3259b0bbe9
- SHA1 2f04894d3fc09d1abd75e1ee697d97dc8771e06f
- SHA512 2503936d51e5e68d8cf5a903aaaf95d0bd0a3868a22d93c9e14895e639a1ad8ec1ae861f1262699e9b691f6b33555559dea88cbac16cc4ba8330bcb2833dd0fa
- TLSH T1AFB01210C1029611C44302B01182048833586F1097051301A3E0AA79D82F1A18124150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5849d5.TMP
- Size 96B
- SHA256 fc44929ea90e1dff9c5d1673496769d1f5d037dd510cb02ccce8d88fd7c5ce0e
- MD5 4e24791e98f740d4fd8a088d01a90ad2
- SHA1 6e73276d4e4441a43a2fb043d071178229d979d7
- SHA512 fbf13b487b51caf255bfc9f2ca1d2136d0d8d8159a3a3b8bd992b297ed9d42cfea564b593119f3276e8059588483f8f424af5e082be8013b8dbf89b0e806ca2a
- TLSH T124B02202C002222AC20283B02283A2EC3220EF3AC203022282E00F32EC20AB00020020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 89d29488f14b547fa9f8a039ef8ae163cdbf7e77f5fcdcd9b79aeea5f4a053a2
- MD5 a285f782ffaaf411c0e587ca1aab2a4f
- SHA1 7c89ea46726b55755c0ddd7266359a018e498393
- SHA512 f154a4ba4e03e88c26f50d9e7f5a0268a578665cd5d7825a9aa5b8643dc8b33e069036628505f7891496065be47fafc1284b63a862375b4637ede2df409e0bdb
- SSDEEP 1536:ZP/ADP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:a++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1ED9312B8691F7C7953ABC6A690079CAC8CD3DCCE1518157C31C36F1E18EE392A34B891
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 61a1c0f66baa5da848182cb1bf6dc183914728511f870cfde5530ab2072037eb
- MD5 739ad3a98f19b065605eee04107f5d16
- SHA1 08f016fd804cdd0ec9a7fd794b55305da8c0a334
- SHA512 c68b4c99d536af5b992947cd9bfc45f707bf6b60a624e028edfa4a5c0564d3e71aeee1bb8e1c8175c993e90369dfb6b03a33270e52b4dd56887db5d8636127b6
- SSDEEP 1536:VP/AIP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:/++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1F99302B8981F7C7953ABD6E690079CAC4CD3DCCE2518257C30C76F1E08BA392A3578A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 e584f75f5c3dfff17f2a09a1c702c5a3b5d2d9076a178084d28190a7af98b95d
- MD5 b3d3ab24d8df1f9777dcb5342ebbcd7e
- SHA1 266bc827e93c1a79774213c708f912b226f69f70
- SHA512 e2aa7c7cfbbe3b01fddcc654c54fd50aa983354eac2ba9c5a2d3836b428abc00e04a11b43aeaefb7fe6a662c4b107f1053f6bc1bbd94f8de32cad547a8a4df29
- SSDEEP 1536:ZP/AIP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:r++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1559302B8981F7C7953ABD6E690079CAC4CD3DCCE2518257C30C36F1E18BA392A3578A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 d86e3a219f6dd6e362926e0072de8f7c3feb56d513ab07b47f816d6c252bd6a9
- MD5 e7f562c373f9e4e946baf98e8512d9d4
- SHA1 7fcaae986dfddc38b3182c0828094dcfec3a2dcd
- SHA512 ca707398da9c7ae2b86817e2b7b730356452e2d6a3e0690a5c1a8f4673c6edddb398e35128e6bea344553cf08e0e619806e55a520f3909705a58bde8a481310b
- SSDEEP 1536:aP/XpP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:c++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1809302B8991F7979536BC6D690179CAC4DD3DCCE111821BC30C66F1E18BA393A31B895
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 6d3853f3c8d039ed2b82c00fb5b544d3e1de7402e94adbdbab5f86b31dcf8573
- MD5 59518e95638f617a47da411da0cea02e
- SHA1 968f4b14e8ff983791601f62010bac1fb9f83e89
- SHA512 29a029f3a7926efd62620610e3c5cde92258467cb827879c95a7eecc285c60c5896b29ae234a1e273db4213c42df146c1c38af18ead71508cb0ecfcebd8bed19
- SSDEEP 1536:oP/ADP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:N++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T13B9312B8691F7C7953ABC6A690079CAC8DD3DCCE1518157C31C36F2E18EE392A34B895
- MD5 SHA1 SHA512 SSDEEP TLSH