Overview
overview
10Static
static
3windhawk_setup.exe
windows11-21h2-x64
10$LOCALAPPD...im.dll
windows11-21h2-x64
3$LOCALAPPD...im.dll
windows11-21h2-x64
1$PLUGINSDI...ol.dll
windows11-21h2-x64
3Compiler/i...ing.js
windows11-21h2-x64
3Compiler/x...++.dll
windows11-21h2-x64
1Compiler/x...nd.dll
windows11-21h2-x64
1Compiler/x...im.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
5Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1UI/resourc...dle.js
windows11-21h2-x64
3UI/resourc...b6.svg
windows11-21h2-x64
6UI/resourc...324.js
windows11-21h2-x64
3UI/resourc...b27.js
windows11-21h2-x64
3UI/resourc...892.js
windows11-21h2-x64
3UI/resourc...ain.js
windows11-21h2-x64
3UI/resourc...on.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ain.js
windows11-21h2-x64
3uninstall.exe
windows11-21h2-x64
4windhawk-x...er.exe
windows11-21h2-x64
1windhawk.exe
windows11-21h2-x64
3Analysis
- max time kernel
600s - max time network
596s - platform
windows11-21h2_x64 - resource
win11-20260130-es - resource tags
arch:x64arch:x86image:win11-20260130-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
windhawk_setup.exe
Resource
win11-20260130-es
windows11-21h2-x64
32 signatures
600 seconds
Behavioral task
behavioral2
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Compiler/include/wil/windowing.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral6
Sample
Compiler/x86_64-w64-mingw32/bin/libc++.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
Compiler/x86_64-w64-mingw32/bin/libunwind.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
Engine/$R1/32/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
Engine/$R1/32/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
Engine/$R1/32/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral12
Sample
Engine/$R1/64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral13
Sample
Engine/$R1/64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
Engine/$R1/64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
Engine/$R1/arm64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
Engine/$R1/arm64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
Engine/$R1/arm64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
UI/resources/app/extensions/clangd/out/bundle.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral19
Sample
UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
Resource
win11-20260130-es
windows11-21h2-x64
13 signatures
600 seconds
Behavioral task
behavioral20
Sample
UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral21
Sample
UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral22
Sample
UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
UI/resources/app/out/vs/code/electron-main/main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral25
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral26
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral27
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral28
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral29
Sample
UI/resources/app/out/vs/workbench/workbench.desktop.main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral30
Sample
uninstall.exe
Resource
win11-20260130-es
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral31
Sample
windhawk-x64-helper.exe
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
windhawk.exe
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
General
- Target UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
- Size 2KB
- Sample260420-jph1eact2k
- SHA256 c26bdd09e6c461fff0b553777c4515bdda9befd69cff7b1530b102dbdd85a48c
- MD5 f7c08269b188d70be6be9ab4120ffd07
- SHA1 175d94e7e29fe652a71e4b1ca105744fa22e58d6
- SHA512 78603032225c92816bed0e8589a372c45630a30cc8f6a778752ccafeed52ab489984f4ae30344d4c0e616e43b3298ce801a8b230d845d3cb50e1fa0c69313472
- TLSH T1214163CC5FA45880419C87C53F53D89C1D57F69945C78D40C08DAF7A419783DBD83996
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4584 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211457000736896" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 1352 chrome.exe 1352 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe Token: SeShutdownPrivilege 5076 chrome.exe Token: SeCreatePagefilePrivilege 5076 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe 5076 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5076 wrote to memory of 4668 5076 chrome.exe 79 PID 5076 wrote to memory of 4584 5076 chrome.exe 80 PID 5076 wrote to memory of 4812 5076 chrome.exe 81 PID 5076 wrote to memory of 4812 5076 chrome.exe 81 PID 5076 wrote to memory of 2876 5076 chrome.exe 83 PID 5076 wrote to memory of 2876 5076 chrome.exe 83 PID 5076 wrote to memory of 2636 5076 chrome.exe 85 PID 5076 wrote to memory of 2636 5076 chrome.exe 85 PID 5076 wrote to memory of 3688 5076 chrome.exe 84 PID 5076 wrote to memory of 3688 5076 chrome.exe 84 PID 5076 wrote to memory of 2160 5076 chrome.exe 86 PID 5076 wrote to memory of 2160 5076 chrome.exe 86 PID 5076 wrote to memory of 596 5076 chrome.exe 88 PID 5076 wrote to memory of 1320 5076 chrome.exe 90 PID 5076 wrote to memory of 1540 5076 chrome.exe 91 PID 5076 wrote to memory of 1456 5076 chrome.exe 92 PID 5076 wrote to memory of 1352 5076 chrome.exe 93 PID 5076 wrote to memory of 4300 5076 chrome.exe 94 PID 5076 wrote to memory of 4300 5076 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\UI\resources\app\out\vs\workbench\browser\parts\editor\media\letterpress-hcDark.svg1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd413c728,0x7fffd413c734,0x7fffd413c7402⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,7187356019529501409,11971590116467141585,524288 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2116 /prefetch:112⤵
- System Time Discovery
PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,7610105854564698717,14623948163081263788,262144 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2000 /prefetch:22⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,3720444907706053370,18176970426452494805,524288 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2352 /prefetch:132⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,6459163019696648353,6417367078667366992,2097152 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3084 /prefetch:12⤵PID:3688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3040,i,433527855796674393,3658774076161296803,2097152 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3056 /prefetch:12⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4184,i,10812265047529749401,18006046392824673297,2097152 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4180 /prefetch:92⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,8100253082120139084,4588139285097198539,524288 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5060 /prefetch:142⤵PID:596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,14509108932469316624,2027616122541282406,524288 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5456 /prefetch:142⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,11488347394610569996,7978257690107991304,524288 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:142⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,15933636665890704400,11142730235208984713,524288 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5516 /prefetch:142⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5428,i,13480952648470699754,13270042239531960278,262144 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5448 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4512,i,14820895306954882385,16668355496835740750,524288 --field-trial-handle=2004,i,7265326286268173027,2785883129057482039,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5452 /prefetch:142⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4792
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4996
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 21ad4f0508040fb9029aeea2efd4cf91bb5c2ebaa700eb2bc06a0e5f897f64d3
- MD5 e08b48fecbb73cda3e8cf2e02257daaf
- SHA1 6bb249efd21ba4cbe02bc78d0d0e59c73d52184b
- SHA512 5ad4ef579c7f06bb1149d49dacb44fe558361f24302126f5f9ddd50a4f98a00a77346c7148f6192a2f1ea2419d9ab3cd15508d7f541db08510118cef37a00961
- TLSH T134E02BEACC11D9370CFD1B1970548647F740135B2B40885B7A3D420D8FB133B464585C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 0344255510f2aebb00b3f937ca1ca9084deb96aade9a9f95126484d2e7de21cb
- MD5 eb57f5d6318216f86590393c1c650650
- SHA1 6b0535922993503e05c3565dd03e5f8c16f57a4f
- SHA512 c062a6465e5b49c4005dbd4e17052996c1fbedbafc558df936228bb129fa9bc544edf4e4d7cafe2afa5ed9758788c40cec80b301059dd6ef3b9fafc011ccd225
- TLSH T19C41BBF793B4997E8A01D2E4EA146F2FCE690921031C7CA6C9D46E1B43F2972E10178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 1f8f8417c61ab7f1ccebdb57da2e4cd7fb63f7b42e525338fa56b2e230715575
- MD5 434c8f9811a7a3a718d8393a00ad85d1
- SHA1 24a36346970ba2b7e6fc32680681b5f23ec74647
- SHA512 162b535dfeca1f102547ba3c1017ccdc63965166f01b7d0f5cef3cddd22def07b3dd1166453585b5a5b3d7ba5a9b3cf061980666911a02da969a1627a9bf8380
- TLSH T1EA41CDF793B49A7E8A0196E4EA146F2FCE690925031C7CA688D46E1B43F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 d47fad4e0a1820de251561c857e5681abcb5e1473ab62702b071d6154546e47a
- MD5 926dc8564df1d53c894792f3beeaa522
- SHA1 4af8e0499c5cea31f8747331290ef9d58c5c9db0
- SHA512 f557c04d926e821b3f8a337e21dbec19d70a554164d8964d7096b3efd47c19c32aa17ba2ef6718e92844415a46b3f751146a4d5cf22068e0eda9ec659fc445b2
- SSDEEP 192:GR7zf81SWGv7spAPRp2kt9AHsb+WNnoSPxIe4QKPawVyIsnAUge:GR7zEfygUXn2wJPpEa0e
- TLSH T1A142D52DB914687B9CDAC22AFE357B57E7F5103560942E84EAFC8A2C14DB6CC3227117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 856741d3ac5d7c45fd0da57d5076b1a3d350388b239c10fc074b63543aef8c2b
- MD5 9ce9e7344b2f78103ddc0a4801aebfcc
- SHA1 65c2a4c9c745342c751d84a2b5bd2e66aa9c55bd
- SHA512 601fdef415d5e4cb2bae300b9a80a8a16b2d92de7f83de5eca6d6c0692d3dbb665aaffd11ab9e3caf6db00c4facf085cda010891501ea6a560d3472c884982ec
- SSDEEP 192:GR7zH81SWGv7spTPRprkt9AHsb+WNnoSPIIe4QKPaAVyIsnAUgE:GR7zcfygVXg2wJPSEaEE
- TLSH T14852F92EB914687B9CD6C629F9257B57E7F5103160D02E84E7FC8A2C14DB6CD3227117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 a337f4a1befd38bf51951276a8a582ad1cad0f1c7152dafd2d792f29e2f074d6
- MD5 9600965f56c8c681f091e28fe0b4f27b
- SHA1 909268efcf3c02c2001fbcf590c52a697341e147
- SHA512 b9a1e810b783726d9254e599ae65877c641e1177651edf7ab9f5f16022ea2b81f29d498e67f6af6b2bedbbe4188c915c2338dcd812c2e239b7e58062c5f9d4b4
- SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLILcmfmnXODAH+ErU3xFH1Wmvyxotf4:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7pJ
- TLSH T162720A677C4C9E770F94CACCD8167A4FADF5025B65E9C8A583FA582903C4ACF11061EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 d773addd2d8834224a8fb54697b6c588a039eed6d7f3218501200e0ae23a1f96
- MD5 6c1145929cd7ed95fd0a51f47511b3c0
- SHA1 e38b1059c303d203c99dc176f1da1fd565e5acc7
- SHA512 252fca1021141ceadd3e8e768c243cec44379edd97ce04e0ec00549afc6dfe59a6d0f7401f487aee069d59dfe8304aad3fd154922efb70dd412a9d9619349008
- TLSH T1A9B0125080019652C00303F4318B04987264AF139F05130193E06E719827290401C150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586a7d.TMP
- Size 96B
- SHA256 a1d1635b794f4b0da054bffe1fda6269ee26d54381d06778a5402f7638923b97
- MD5 47a147b45f46324bf419404c00adeeec
- SHA1 bf306fc2d16e63a52112a3ab2e3bb3984949ac92
- SHA512 480dcde68c2617068f5e6b771413c7fd31cc34e2806822e3cf46672ba8d39c9d0d470d0b6c5fbe7f2260381ce54d83b4d5d07fbe740c5a472dce9e2e1964f6c0
- TLSH T15DB0220CC002B30AE0820BB038A3E0C83020EF28C2030A22C2E00A2BCC202A0002A022
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 9ed6d1dc3a41d7226ae4062877cb5e07bcc4c000aa1d837bc2d5954bcb67ad8b
- MD5 4a68739fe20801927ea6401000058bc1
- SHA1 e55377a4469bedcd109771f421640f0b1e6bf581
- SHA512 35898c09cb0ccbcd514d2985a35de9f06b4cb6e0e7840875ffa08a98f17a1deb700f1455db1e85b6205aaf8369d1ce88a777c9f861396ea07809e3da36668dd6
- SSDEEP 1536:6LeP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:u0++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T17A9312B9991E7C3963AFD7A6A0079CAC4CE3DCCE1514547C30C76F0E14BA392A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 430e109dd2dff56b24919936f3d06a3a67f33cb3c6aa5ab7e7236fa98e5a0e7d
- MD5 8e2ab34848c3dc7d6bc9d37473ba5d17
- SHA1 3b2167772a2d2bc50af438dd8acce05f66446a6f
- SHA512 2c12559c5208ca1515dc0adb31896488ce9dfd1534b7d647e1ca4829d8bc3edaa3d49e21585248d2e227516d156a7aec365b07742ce3f068aaf1ecd918a181ca
- SSDEEP 1536:PLeP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:T0++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1339312B9991E7C3963AFD7A6A0079CAC4CE3DCCE1514547C31C76F0E14BA392A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 bc0d8ad96668a6f489b4a5741ef62f723031afb7fad8853bc0a37c8757caa10d
- MD5 57a34ef13486cea6b721aaccf21212bd
- SHA1 8b82e19b9b99b916e860e50da287dfa951845a77
- SHA512 fe38ad5e811876b5d13106002c50cd60ec257e9c01acc2e76f1425473fc4844cd6d7d3cf8a88406283a49d35aac5094f7f0af5e03ca63b3e5c3915db8c8fad01
- SSDEEP 1536:zLP0P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:nPK++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1509302B9991E7C3963ABD6D6A0079CAC4CD3DCCE1514257C30C76F0E14BA392A35B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 92951b57e3142c9b75b554676491cc6263bf33e9fb91e13e8bbb09e5809bf352
- MD5 3bcec575b1bafc0c6cc425d1bb1f4398
- SHA1 88425e78832da44d6c3c6b0940628841b4fd6644
- SHA512 b9a8a74ac067f35e810c99a4fdf1e45bf45bd67b9e877e3b3158c63c6c1e78fd132f000ac3f03594263b59a2a82a02a90adf730ba10ff94634e84b9daa3ca5d6
- SSDEEP 1536:4LNP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gF++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1E79302B9991E7D79636ED396A0179CAC8CD3DCCE1510517C30C76F0E14BA3A3A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c8d5cf99-2bdd-41b5-b2e2-182ff144b9c7.tmp
- Size 91KB
- SHA256 39b449f37a7593d5065b687a86d814090078a6afcb9a4ac8e290f36ff1a938f7
- MD5 ffda88312baf834a142ca2b794cb6df3
- SHA1 280e41b0da41359de032dbe4eaccd553da12e028
- SHA512 7c7bdbefff1e1a0f03d2b790121adc6421f1831fa4c1f165e36916d86bcbd4f858b9175df364c656f32d495b350e911ecd58045dea88a09abd9bcaa5220b85d9
- SSDEEP 1536:PLP0P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:TPK++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1D49302B9991E7C3953ABD6D6A0079CAC4CD3DCCE2514657C30C76F0E14BA3D2A35B8A2
- MD5 SHA1 SHA512 SSDEEP TLSH