Overview
overview
10Static
static
3windhawk_setup.exe
windows11-21h2-x64
10$LOCALAPPD...im.dll
windows11-21h2-x64
3$LOCALAPPD...im.dll
windows11-21h2-x64
1$PLUGINSDI...ol.dll
windows11-21h2-x64
3Compiler/i...ing.js
windows11-21h2-x64
3Compiler/x...++.dll
windows11-21h2-x64
1Compiler/x...nd.dll
windows11-21h2-x64
1Compiler/x...im.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
5Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1UI/resourc...dle.js
windows11-21h2-x64
3UI/resourc...b6.svg
windows11-21h2-x64
6UI/resourc...324.js
windows11-21h2-x64
3UI/resourc...b27.js
windows11-21h2-x64
3UI/resourc...892.js
windows11-21h2-x64
3UI/resourc...ain.js
windows11-21h2-x64
3UI/resourc...on.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ain.js
windows11-21h2-x64
3uninstall.exe
windows11-21h2-x64
4windhawk-x...er.exe
windows11-21h2-x64
1windhawk.exe
windows11-21h2-x64
3Analysis
- max time kernel
600s - max time network
600s - platform
windows11-21h2_x64 - resource
win11-20260130-es - resource tags
arch:x64arch:x86image:win11-20260130-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
windhawk_setup.exe
Resource
win11-20260130-es
windows11-21h2-x64
32 signatures
600 seconds
Behavioral task
behavioral2
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Compiler/include/wil/windowing.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral6
Sample
Compiler/x86_64-w64-mingw32/bin/libc++.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
Compiler/x86_64-w64-mingw32/bin/libunwind.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
Engine/$R1/32/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
Engine/$R1/32/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
Engine/$R1/32/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral12
Sample
Engine/$R1/64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral13
Sample
Engine/$R1/64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
Engine/$R1/64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
Engine/$R1/arm64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
Engine/$R1/arm64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
Engine/$R1/arm64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
UI/resources/app/extensions/clangd/out/bundle.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral19
Sample
UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
Resource
win11-20260130-es
windows11-21h2-x64
13 signatures
600 seconds
Behavioral task
behavioral20
Sample
UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral21
Sample
UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral22
Sample
UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
UI/resources/app/out/vs/code/electron-main/main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral25
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral26
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral27
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral28
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral29
Sample
UI/resources/app/out/vs/workbench/workbench.desktop.main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral30
Sample
uninstall.exe
Resource
win11-20260130-es
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral31
Sample
windhawk-x64-helper.exe
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
windhawk.exe
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
General
- Target UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
- Size 2KB
- Sample260420-jph1eact2k
- SHA256 3d88dc275cd053bb28435aff34bc98a5bae0ae755d2bbb7f4dc09c324a40c63c
- MD5 aab566666eda5d5a771b84aac35e65e4
- SHA1 4d75b6e976f4de25d6a1da9abd928e058934db8e
- SHA512 79132149729d35e391ba08b39249e5df21fff580e193327850fd3420515ed4b550b74411fc841ff3f6d9ccae2c22f73300f9b6d50805a970e7b5ed8b38e0629f
- TLSH T1DE4161CC5FA8588080DC8BC53F53D8981D97F69989C78D50C08DAFBB419783DBE83996
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6000 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211456121023441" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 1260 chrome.exe 1260 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe Token: SeShutdownPrivilege 5368 chrome.exe Token: SeCreatePagefilePrivilege 5368 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe 5368 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5368 wrote to memory of 5036 5368 chrome.exe 79 PID 5368 wrote to memory of 4032 5368 chrome.exe 80 PID 5368 wrote to memory of 4032 5368 chrome.exe 80 PID 5368 wrote to memory of 6000 5368 chrome.exe 81 PID 5368 wrote to memory of 4532 5368 chrome.exe 83 PID 5368 wrote to memory of 4532 5368 chrome.exe 83 PID 5368 wrote to memory of 2952 5368 chrome.exe 84 PID 5368 wrote to memory of 2952 5368 chrome.exe 84 PID 5368 wrote to memory of 4100 5368 chrome.exe 85 PID 5368 wrote to memory of 4100 5368 chrome.exe 85 PID 5368 wrote to memory of 2672 5368 chrome.exe 86 PID 5368 wrote to memory of 2672 5368 chrome.exe 86 PID 5368 wrote to memory of 5584 5368 chrome.exe 88 PID 5368 wrote to memory of 2724 5368 chrome.exe 90 PID 5368 wrote to memory of 1512 5368 chrome.exe 91 PID 5368 wrote to memory of 1592 5368 chrome.exe 92 PID 5368 wrote to memory of 1260 5368 chrome.exe 93 PID 5368 wrote to memory of 5624 5368 chrome.exe 94 PID 5368 wrote to memory of 5624 5368 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\UI\resources\app\out\vs\workbench\browser\parts\editor\media\letterpress-dark.svg1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff873dec728,0x7ff873dec734,0x7ff873dec7402⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,6073546098517096951,13444255956156498719,262144 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:4032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,12890920647457575815,13390806382856582825,524288 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2228 /prefetch:112⤵
- System Time Discovery
PID:6000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,12273312042014140997,9940479381514373925,524288 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1812 /prefetch:132⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,11754583242007614247,14780090420319192130,2097152 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,17523498075768904141,7763355519560898513,2097152 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4168,i,5734087209154009169,18321481982133579173,2097152 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4164 /prefetch:92⤵PID:2672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,18163861350337065005,13501269746869685331,524288 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5520 /prefetch:142⤵PID:5584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,9140477373010958748,15664701523918063408,524288 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5724 /prefetch:142⤵PID:2724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,11939911229110959040,4762271631234797997,524288 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5488 /prefetch:142⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,10877467350099505347,10119426585620679719,524288 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5452 /prefetch:142⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5788,i,10004353636476895008,11168577218581831425,262144 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5348 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,2394740186016939696,6679790760262249612,524288 --field-trial-handle=1932,i,10561659174122399713,17479237347187822158,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3792 /prefetch:142⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:6140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6c4dfda8-45b2-4567-9ef6-317894b2e03d.tmp
- Size 12KB
- SHA256 881849c521e1f658f7cd2981010fd3828492cc13c16d4413a947f7af5635e673
- MD5 1f8b8bc93fd83059b4c35926e2a8bc4d
- SHA1 52067edd71bb7daf1e0d0d7a20634f669f05b96f
- SHA512 05f9b2b7911176e5017e47f5da9d8e90e24c222aaa8571db56a1f09aae2732a44fe54e9861bd9bf086c8e6c7e51a28b0463a5bd7f75480566e455f97be9d6b1d
- SSDEEP 192:zRgqfcj5gv7+FpAPRp2LS9hHsb+WNnHJPMLnb23eznVIxVyIsnAUgE:zRgqm86FUXZbwpPWb2inVWE
- TLSH T13242E96EFA1079779CDBD225FE617717E7F5102520901E84EAFC8A1C15EBACD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 ccb9979cbd9ef4a8e9cbcbafb0c89672d4e63db5db90f008d3dc06b7f72e7e10
- MD5 f633364dfd61744668a01ca69cef023d
- SHA1 60af3c306007cbfdb5e8fb32e00484696f991386
- SHA512 8f23004915ff3d9c2e98dd5680246e44ef33a3990a10ee0d23859e7ab78f7d65dbe1ab7713362d0455dc3687e5290630d52f5a949e155467b83d052ca5d4aebf
- TLSH T120E02BEAC829DC374CFE0B1860905747F64013972751891F7A3D820D8F7173E0195C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 bb22f75d15f553e6f3190e55a74d37d5660965661bb617d7a13685a324e7e408
- MD5 1ec18b2fed757945709c03928972434c
- SHA1 f5b2b0d519ff71344d596d93bbeace102cb8a5c9
- SHA512 df4217cd3b9d7b274d789e696e3fde72e65b03c8aedc160448b9cb760361ab91168a49849148117af20d9c58abefc443f0cc84dc732ab7ba800dad1dabb9a90e
- TLSH T1AC41ACF793B4997E851192E4DA24AE2FCE7D0924031C7C6289D4AE1B43F2972E20178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 8ffa2d3b2b4a0db2f0a25b2c81a209bb3a8e61fc1713be2515af957f77ec2b09
- MD5 b0aa2e4796f59b2406873488d659081f
- SHA1 aa4f72ed69b3fc0728971fae6dceafac6dd28edd
- SHA512 95a9d86621aeb313aef29c1a79e94df953b97d1ae2c729c1596925086e9cd57dcae5d79ef23c93ad8d832a93886e77214b38047ab320951dcf40941f9128e8ea
- TLSH T196518DF793B4997D8A1196F4EA156E2FCE690924031C7C6289D4AE1B43F2972D24078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 197ede0bc27accb789de3f0bc0d76427b911e1ec8e6f187452e590f267e0c7a5
- MD5 ca8902b11296a472e6af9aee1f81aa40
- SHA1 13f4f4f8fc9ef2a36079c5e804ba7f3cc7b33b39
- SHA512 0be05f87d8012ac8e556576355f6d8f07d8cf036cdfba92724de3d90ba163aa38de3045fe6fc0c2d0f85c1506436855681da705da4642b8b8347de0ce555712a
- SSDEEP 192:zRgqnzhKHajwj5gv7+FpAPRp2LS9hHsb+WNnHJPbLnb23eznVIHVyIsnAUge:zRgqz6ai86FUXZbwpPXb2inVce
- TLSH T1F742FA6EEA54657B9CEBC225FD617B17E7F5102531901E84FAFC8A2C11EBACD212700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 021a5ab12a2d044f84c2c9da1197b282318fe82613d29699668fc54369227d75
- MD5 0daa539d73aac1c4226e0295f06f9ef2
- SHA1 b4f0695754a7ad296abc52f5508b14b2a994623d
- SHA512 e5926c0264ac2debbcba84593475ae64e417abdf4e79206fae07cb1209a3e79e8f22541253d0660504029ec5b22079225e1217c35f819e99c2f9741d20c378f0
- SSDEEP 192:zRgqncj5gv7+FpCPRpsLS9hHsb+WNnHJPjLnb23eznVI3VyIsnAUgE:zRgqu86FqXHbwpPvb2inVKE
- TLSH T14C52F96EF91069779CDBC229FD617B17E7F5102521901E88EAFC8B1C15EBACD222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 f724a1bc5a4b0f469255d1eededff00075b720e9be8908e63326a65ea6dbb127
- MD5 781e6995139b19c9ee739e0431e54252
- SHA1 6746e1130c6b04a03fea0ef142c26122b7a10d33
- SHA512 af9b90dbe640951bc8c0ae4b47fb9e690137badf271aa753932f4f202a9573bc6f751af7504b71c330a6b01f154121c5d95ed1ef749a70b44dd6f04b4073e46a
- SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLILcmfyTXOD0b+ErU3waH1USqs:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pg
- TLSH T1BB7219676C4C9E7B0F94CACCC8177A4FADB5024B65D9C86943FA582903D9ACF11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 be8029c793ac9f4150aae87316f63e03eb02c29119156482117a8e4b98dbc907
- MD5 9d514177b21ce11e8d0a07f960c1a44c
- SHA1 8df70ed391b93729fa88593a7136ad0495194ffe
- SHA512 f62e7604e9784dbe47ee0a0a88349d81b5a9d67f1ee704158ae04876a7ef7991ba944f25e254859b554bf55769ea92ee5702defa1bd8c2e1e5ddd90ad647e1d1
- TLSH T10BB0121080019602C08302F02286448C31185F24D706270253E07B71D82A5A18014151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588eed.TMP
- Size 96B
- SHA256 64e40b7f1f8a583b50587114554c743841021dca41cda41393a7dacb8e2f4109
- MD5 eb1a204377a013680bba8a4fe3f77ac5
- SHA1 e6f4e8c42b4965947fc71962cecf114518aefc57
- SHA512 52a47fead3e7ccb85af93defb1d20b739ee760404766dd072465b8b9f3f57dbb7bc8aa712e8c972c68e4c0ff422ff394cfcbaedf501f0d949c1011bd4147c139
- TLSH T176B02208C0022F02C0C203B0308883C83030EF30C20B020282E00A22CC20B320020220
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 da1ddb64c26ed65f5ffa605dc9aad9ec4badb00a9c67cf043fcafcf45d687c9a
- MD5 fdb40b211c22bc55d519ac7f40e9bdd6
- SHA1 bf9be9cfcaf0b6e004185521e12c80054032193e
- SHA512 4139d66793de3255a2b8ed2554ad4b0a1e70a9b9a26442da0eddcaf0a9bf711159bc8b63685cabbc608ea2140f5942125dcb95c87a8e9847c0b340780322164b
- SSDEEP 1536:hGKLuP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:9Lk++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T1FA9312B9991E7D7963AAD6D6A0079CAC88D3CCCE1518257C30C79F0E14BE393D30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 ad7dc1f37b0762148a0e99c4f48261d838f447871c32b5a08a8b9134ec4caa57
- MD5 8acdc1f832724c4779b7b4a5f2a1295e
- SHA1 8fe69b45e3d7d9bfa93c19d846970e1c3f5fdc71
- SHA512 aa5a87b3e40f1e974193de5fffe9926de97374ceb98884acbda0daa8971aa442a37f2844fdc0863cb02249e9ac667c62eb0fd0320482c648029b527db3209264
- SSDEEP 1536:aGVRP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:VZ++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T12F9312B9991E7D3563ABC7E6A0079CAD8CE3DCCE1514127C31C75F1E14AE392A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 172c2eb71c9e8361d3de822ae089cc5df873b240ce45d3df92a6bd0cef93e989
- MD5 3f61c49ec1afe6d25ec8f58826180434
- SHA1 a3d6dce6841df037505634ad7a7c7937bd35335f
- SHA512 c9ce1723330ecfa7630a6653ecda4ffc7a945188cce6db857a30a10f3de4bea91620ab176db247ed88e03ef8d1628a9a32a9ceaf722679973fdf54c40fa2a82b
- SSDEEP 1536:hGVRP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:SZ++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T1899312B9991E7D3563ABC7E6A0079CAD8CE3DCCE1514117C31C75F1E14AE392A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 395f3c504e3fc12706c252e00cda462861aa69ae079084882e5b9416d05a07e9
- MD5 124f6a1d359699b90c78575fea56dcc1
- SHA1 f34a2c66bae17a108acd8df335a662e5bfdce1d4
- SHA512 efdf0bb4f5c905a5ba5ba8117b49ad90ad86a538fb07428a0b034495c3d05a4f6bf2485fd69faf01f0d7df0663105937ed0ecd9b6d6430312083d86a127e283e
- SSDEEP 1536:ZGKLuP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:lLk++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T1429312B9991E7D7963AAD6E6A0079CAC48D3CCCE1518257C30C76F1E14BE393D30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 0fc59698efdf1de3b9904a480f989e596c3934b65cf3efca108f49048d4cba3a
- MD5 c6d6b65cd3cc873c4cc44e07e25df5c4
- SHA1 ef7fdde23b3ec8cda883d875991f9028962ef1b5
- SHA512 9553874dca5f9f59cf710412a3760a3e4221c862c6ec7bb30f17f97dbfdc4f26b3ad0bf7e154cf7ae95e515d028803ebdd50044968cbe6d20cf84f98607efee6
- SSDEEP 1536:eGJdAP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:Hm++J3qUQm08KMWF0bFTcVHr6zD
- TLSH T1D69312B9991E7D75636AC6D6A0079DAC88E3DCCE1514117C30C7AB1E18BE393A30B8E5
- MD5 SHA1 SHA512 SSDEEP TLSH