Overview
overview
10Static
static
3windhawk_setup.exe
windows11-21h2-x64
10$LOCALAPPD...im.dll
windows11-21h2-x64
3$LOCALAPPD...im.dll
windows11-21h2-x64
1$PLUGINSDI...ol.dll
windows11-21h2-x64
3Compiler/i...ing.js
windows11-21h2-x64
3Compiler/x...++.dll
windows11-21h2-x64
1Compiler/x...nd.dll
windows11-21h2-x64
1Compiler/x...im.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
5Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1UI/resourc...dle.js
windows11-21h2-x64
3UI/resourc...b6.svg
windows11-21h2-x64
6UI/resourc...324.js
windows11-21h2-x64
3UI/resourc...b27.js
windows11-21h2-x64
3UI/resourc...892.js
windows11-21h2-x64
3UI/resourc...ain.js
windows11-21h2-x64
3UI/resourc...on.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ain.js
windows11-21h2-x64
3uninstall.exe
windows11-21h2-x64
4windhawk-x...er.exe
windows11-21h2-x64
1windhawk.exe
windows11-21h2-x64
3Analysis
- max time kernel
600s - max time network
599s - platform
windows11-21h2_x64 - resource
win11-20260130-es - resource tags
arch:x64arch:x86image:win11-20260130-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
windhawk_setup.exe
Resource
win11-20260130-es
windows11-21h2-x64
32 signatures
600 seconds
Behavioral task
behavioral2
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Compiler/include/wil/windowing.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral6
Sample
Compiler/x86_64-w64-mingw32/bin/libc++.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
Compiler/x86_64-w64-mingw32/bin/libunwind.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
Engine/$R1/32/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
Engine/$R1/32/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
Engine/$R1/32/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral12
Sample
Engine/$R1/64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral13
Sample
Engine/$R1/64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
Engine/$R1/64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
Engine/$R1/arm64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
Engine/$R1/arm64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
Engine/$R1/arm64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
UI/resources/app/extensions/clangd/out/bundle.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral19
Sample
UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
Resource
win11-20260130-es
windows11-21h2-x64
13 signatures
600 seconds
Behavioral task
behavioral20
Sample
UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral21
Sample
UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral22
Sample
UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
UI/resources/app/out/vs/code/electron-main/main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral25
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral26
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral27
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral28
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral29
Sample
UI/resources/app/out/vs/workbench/workbench.desktop.main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral30
Sample
uninstall.exe
Resource
win11-20260130-es
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral31
Sample
windhawk-x64-helper.exe
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
windhawk.exe
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
General
- Target UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
- Size 2KB
- Sample260420-jph1eact2k
- SHA256 469bee8975d893e4085d00d9a59fbc09c14b0c1bcb47f3292b611a24ee703193
- MD5 cfa2cf830cfb2bca8f8eeaa7bcfd99a9
- SHA1 952266e3e56079bb4f47c85fb1b2fb56a550618b
- SHA512 bd5c4edc9e52fcb8cee133cacdbfa248983427919e03c33bfceabdd4dec5f05cda8142b835b73dd990c2e1ab97b6691b05185cb93bc4f5a71d4f7a29e2abc147
- TLSH T121419728830803F4F11E574CC4C529AA36D978EBB148F79C91597C95E5DAD640C171EF
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1336 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211450982757155" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 1124 chrome.exe 1124 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe Token: SeShutdownPrivilege 4848 chrome.exe Token: SeCreatePagefilePrivilege 4848 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe 4848 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4848 wrote to memory of 4768 4848 chrome.exe 79 PID 4848 wrote to memory of 1336 4848 chrome.exe 81 PID 4848 wrote to memory of 3304 4848 chrome.exe 80 PID 4848 wrote to memory of 3304 4848 chrome.exe 80 PID 4848 wrote to memory of 4908 4848 chrome.exe 82 PID 4848 wrote to memory of 4908 4848 chrome.exe 82 PID 4848 wrote to memory of 1860 4848 chrome.exe 84 PID 4848 wrote to memory of 1860 4848 chrome.exe 84 PID 4848 wrote to memory of 5232 4848 chrome.exe 85 PID 4848 wrote to memory of 5232 4848 chrome.exe 85 PID 4848 wrote to memory of 3148 4848 chrome.exe 87 PID 4848 wrote to memory of 3148 4848 chrome.exe 87 PID 4848 wrote to memory of 5840 4848 chrome.exe 88 PID 4848 wrote to memory of 6080 4848 chrome.exe 90 PID 4848 wrote to memory of 2468 4848 chrome.exe 91 PID 4848 wrote to memory of 3900 4848 chrome.exe 92 PID 4848 wrote to memory of 1124 4848 chrome.exe 93 PID 4848 wrote to memory of 5316 4848 chrome.exe 94 PID 4848 wrote to memory of 5316 4848 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\UI\resources\app\out\vs\workbench\browser\media\code-icon.svg1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffecf0c728,0x7fffecf0c734,0x7fffecf0c7402⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,14691905099587085627,7690233216746665905,262144 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,14068200466716232923,16826545202427179856,524288 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2148 /prefetch:112⤵
- System Time Discovery
PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,4996771681538059799,1371449070791750404,524288 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2440 /prefetch:132⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,11785326169976175350,10031499269337597842,2097152 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,12094841630531816857,5466987129949249888,2097152 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:5232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4136,i,15469074582273929255,4187354761182220430,2097152 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4104 /prefetch:92⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,2278246529718835983,7269504852168121817,524288 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5196 /prefetch:142⤵PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,12828336927202636516,17843023864620860472,524288 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5540 /prefetch:142⤵PID:6080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,9839891966168706513,16380066292422941360,524288 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5600 /prefetch:142⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,6593463072357241017,3199233199881760247,524288 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5488 /prefetch:142⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5704,i,5076839086786967252,13485056879263806187,262144 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5684 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4464,i,5028791925275315753,5730964724448626748,524288 --field-trial-handle=1948,i,1759933085713366041,17392371501495174997,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5692 /prefetch:142⤵PID:5316
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 57b7992a3fe3933aac67ede4093a4654e9f2ad8e99dbba12d7110e557d979f5f
- MD5 c18e3bed7b1f5bd4d0dc37ca44456f8f
- SHA1 3880c506f8dcd3a86b72ccad6be421fa9a6b00ee
- SHA512 212c16fda31a7530ed8343d5eced1487145a30ebfa52b2223e30eb98c36e30b343d712a8a410f3a85bd11fdeb753a5fa417e166113a1535b20af601b20e8d292
- TLSH T1F2E022EED821DC2B18FD0B2CA0914746E758236B2F90898B3B3C91098FB173A06C9C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4325a2f4-de36-4b51-935b-f9e38f309088.tmp
- Size 2KB
- SHA256 56a70bc0903fa1b8ae5576c8494994a27288db819846569ade05e92d0e05cc6c
- MD5 bbd2e3d6cc0fbd7aca8da75ee18575c3
- SHA1 2b76b5c75e4f9a3c1dffc9887839609bd5c526af
- SHA512 dadce4954157b0e365973e864fbe40b5ffd3d3e3a6eff655d7ab0d2f0b6fea3bf56fcea8d18d355ba39643c6ae7bf572f5defdfe9582802d543ecb1358a7abae
- TLSH T145418BF793B4997E861192E4DA146F2FCE790924131C7CA289D4AE1B83F2973D20178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 e036a5c43aca445d8cee3e37edf27afcd3517be5e4e16c808cd3bdfabcdb329b
- MD5 133ad35f093494b15e5b31827cbf755f
- SHA1 4c7c3f0b9427baa808e92035dd87c2b3fecf783f
- SHA512 2c2a3663662c773e3f37708c9133f43d10029db9cb4f8a8d33062cf1a6e51fec5a1f454dd36dd8480e713314911b2e7c08d625b30a6bd4eb164a6110afd75bcc
- TLSH T10B51ADF793B4D57D8A1196F4EA156E2FCE790924031C7CA288D4AE1B53F2972D20078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 468be4cb08890a046a373555053c025ead7833f72ff9500765ca4c55769aa3ef
- MD5 517a2e539a4638ce32f41a88943d7bf4
- SHA1 68035242226daa3a061aeb28f814a866dfbcf899
- SHA512 f5543e78fd8ae1671d8d330c72e802925d6eb9016da70edf2c8c892685dcd6839299361d39c4eb4f5c5dbe490f1c15dd7c54c7470671a9131f3c08e06672580e
- SSDEEP 192:xQRqif0Muxe+x0vD7CIv7XpAPRp2uZ9BHsb+WNnabhPmse1d9TlHflL+VyIsnAUp:mRqisMMcL7UXFDwmPMd9xJ2e
- TLSH T15042E72DAE1465379CCBD22AFD65BB17E7F2102161842E84EAFC893C15D76CD222711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 0d2fdb09d00ecd4aad2f8d47f69b1a8bc2100de38b53a1f0476fd9918e060800
- MD5 c0fdc7e2a84c502981e1b5814caaa025
- SHA1 5545a5468c524e8bc182ec07005ba546b6d16012
- SHA512 7958f4ae33c634d10f3ec66727e9f4ecfbc3387da52b0df3016cf2bcdcfbe3e41c2c6f517cb41ea5c4f89afda15e29b289740f7df665aa939ea3eec9f49e4b7f
- SSDEEP 192:xQRqiq0Muxe+x0vD7CIv7XpWPRpUuZ9BHsb+WNnabhPMse1d9TlHfVL+VyIsnAU3:mRqipMMcL7mX3DwmP+d9x52E
- TLSH T12052F92EFA0468379CC7D229FD65BF17E7F2102661901E84EAFC8A2C15E76CD2217117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 797a66035ebf115e19a5c852a83575a3420ad1174c539bdb1d6a15141e38be5d
- MD5 09b2266a27756bedb97ee23174baf8ee
- SHA1 d10af69229e909eb16528e586aa902eef36c8c57
- SHA512 d537085d84fe3a777bf416296b5a4eb52280d380597629a157a7e11eba6f6a7e3cca2f20a2b02b338d21b66514cc8e1c80efc300f46d7afb30defc2d7de663b1
- SSDEEP 384:4qj0v7KxkXqKf/pUZNCgVLH2Hfgsl0X7pLILcmfa7XOD0z+ErU3W3H1WTStAAW:460v7KxkXqKf/pUZNCgVLH2HfgsyX7pm
- TLSH T16F72F867AC4C9A770F94C68DD827BA4FADB5014B64D9886443FB581903C5ACB150A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 08aff486f8c865fc29160dbd8af84b45761cb33b2ef1ba2613aa3f8dac4e2adb
- MD5 439aad033fa16fb28bd790cb8f1deb47
- SHA1 9fdf186d2055d64fbab597e3c88592247bfd34a9
- SHA512 1cc79abd8a1cdb8fcab7a09807896985975193dbd80aab1a95237477340efc9dab5acc8f65b99e7c52fd870f156a2c10afd26918cb88b8dceb9f80c377ef72b7
- TLSH T1BFB012108442D611D84303B51592888832645F118705170693F8BE75D82F5A14024350
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588102.TMP
- Size 96B
- SHA256 21c4ae559bc4bcdc7642b1e6aeb47815afec565f6a3575ebfd7fd747a3d30c36
- MD5 4a1907a068e8e41caac4ec706bf47d94
- SHA1 7e8bfcdaeac97684aeb283e9f6a03303427230b9
- SHA512 2b6c4408b997583f7db52b3f1d1e5f9dd09d91671cf377069bf6689beedf09de5201540d927a7bd9616470fb9cae6d3eadfab726895896c81ac94f0efa446b3a
- TLSH T1C8B0220BC003F302C00203B02283C0ECB030CF20CA030202C2E00A22CCA03320038038
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 61c60dda2f1edfd7ab95633d3c2c78091578f8edd6a66f60ca7f1bc723ffbab6
- MD5 175cd7b2fc0c07a7d8928c1f5bbece91
- SHA1 b678935bf561fcd27fdd31d1ee1145f55e47ddcb
- SHA512 c0ad549141d8584788f91a5c126828938be6366d1f15287574ebdc9e511f89234878c8da806218636d22bfaad1fa4db500dcdc50628616379f67e5616cce9b9e
- SSDEEP 1536:0P/10P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:p++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1F89312B8981F7D7953ABD6A690079CAC4CD3DCCE2508257C30C36F1E04FA392A3478A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 723c55b5036f48e5d2f3f6b3af5aba77bf84ad7d308b32419f144abecfe2d550
- MD5 28ef562cb555f5d0989d1681e0686e4a
- SHA1 f187c587caeaec3c6441edda17b69fc9ceef7997
- SHA512 bfbd2be71e8b518a75aa3c1f63964fa3bc8e4c479c73251d0d18edacd08676240685cfb706a6151a39781a142f9d74d5482f80d93371bba576764e0ad5ad7e8b
- SSDEEP 1536:EP/10P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:Z++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1909302B8981F7D7953ABD6E690079CAC4CD3DCCE2518257C30C76F1E14BA392A3578A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 c1bdb43ba48fbd0571544a62b6735dcffed69ea687a882ce3c9e8a74bf9cb78e
- MD5 e0c17bba5ff49d2dbb5510d5883fa31f
- SHA1 73a2c3b90e4e52997c5c58a319e873e5a2ddfc3c
- SHA512 65803f77aa904252f6ff3449f0e826646f4767bd757645a5ff0e1874323167b932b6ee8540f9db0cb13514b0e51da972ceb0753b4c2b1f46c9fc3e593860e930
- SSDEEP 1536:EP/11P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:e++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1309302B8691E7C7953ABC6A690079CAC8DD3DCCE1518157C31C76F1E18FE392A34B8A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 fed1602c1d34abcc230b1427d01cdf16425eeb417dad1430b3f22047b06e1408
- MD5 ea022bd4b0e73d6cbec793fd1f19722c
- SHA1 82e1352a89c2b7c2c3a6d515d3ec44e8616b7518
- SHA512 f3c5c0890533a2c66d6f2f94fc2d027880b68fa2e0f6c81bdfe22f905d1856ae0c2280f814fee0467e4fc80ede02a3211c11393e984cce678876c29be7918269
- SSDEEP 1536:PP/11P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:X++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T1DE9302B8691E7C7953ABC6A690079CAC8DD3DCCE1518157C31C76F1E18FE392A34B8A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 52e1a162708be1d0e050013de8fca6dd35b41a39ca4d4bfd1d4b5ac182a49894
- MD5 c7ae452a981ffea6d7f919f17f0eae86
- SHA1 43d88a1bdfaa09364b43c7934618af60d0caf784
- SHA512 905b8fc2c18f68e517a5fd70498b031cef890e30367c34dc1716f04eb0d9d4afd8983789ffcd88579e5d748d7e58e0221b2f83ef192c912acdee5289725db359
- SSDEEP 1536:aP/3YP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNx:L++J3qUQm08KMWF0bFTcVHr6z2
- TLSH T10D9302B8991F7979536BC6A690179CAC8DD3DCCE111421BC30C66F1E18BA393A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH