Overview
overview
10Static
static
3windhawk_setup.exe
windows11-21h2-x64
10$LOCALAPPD...im.dll
windows11-21h2-x64
3$LOCALAPPD...im.dll
windows11-21h2-x64
1$PLUGINSDI...ol.dll
windows11-21h2-x64
3Compiler/i...ing.js
windows11-21h2-x64
3Compiler/x...++.dll
windows11-21h2-x64
1Compiler/x...nd.dll
windows11-21h2-x64
1Compiler/x...im.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
5Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1UI/resourc...dle.js
windows11-21h2-x64
3UI/resourc...b6.svg
windows11-21h2-x64
6UI/resourc...324.js
windows11-21h2-x64
3UI/resourc...b27.js
windows11-21h2-x64
3UI/resourc...892.js
windows11-21h2-x64
3UI/resourc...ain.js
windows11-21h2-x64
3UI/resourc...on.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ain.js
windows11-21h2-x64
3uninstall.exe
windows11-21h2-x64
4windhawk-x...er.exe
windows11-21h2-x64
1windhawk.exe
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
599s - platform
windows11-21h2_x64 - resource
win11-20260130-es - resource tags
arch:x64arch:x86image:win11-20260130-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
windhawk_setup.exe
Resource
win11-20260130-es
windows11-21h2-x64
32 signatures
600 seconds
Behavioral task
behavioral2
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Compiler/include/wil/windowing.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral6
Sample
Compiler/x86_64-w64-mingw32/bin/libc++.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
Compiler/x86_64-w64-mingw32/bin/libunwind.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
Engine/$R1/32/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
Engine/$R1/32/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
Engine/$R1/32/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral12
Sample
Engine/$R1/64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral13
Sample
Engine/$R1/64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
Engine/$R1/64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
Engine/$R1/arm64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
Engine/$R1/arm64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
Engine/$R1/arm64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
UI/resources/app/extensions/clangd/out/bundle.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral19
Sample
UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
Resource
win11-20260130-es
windows11-21h2-x64
13 signatures
600 seconds
Behavioral task
behavioral20
Sample
UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral21
Sample
UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral22
Sample
UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
UI/resources/app/out/vs/code/electron-main/main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral25
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral26
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral27
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral28
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral29
Sample
UI/resources/app/out/vs/workbench/workbench.desktop.main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral30
Sample
uninstall.exe
Resource
win11-20260130-es
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral31
Sample
windhawk-x64-helper.exe
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
windhawk.exe
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
General
- Target UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
- Size 2KB
- Sample260420-jph1eact2k
- SHA256 fe3f5dcfe0c6220932918777540fdbe2acb3f8229a56129fab2e0b4d08977c09
- MD5 95429443e1d822c98c49940588e44f89
- SHA1 d95c099fdf3cdfa9818bc98f04858888c8767994
- SHA512 eee65444613c51a082525102d637157fb3ac9726b6d1257ba11f22b7313ef87b387ffeab78019312bba0edb8d7cce3254a81586e02f835ba6a6b01d6f054cbe8
- TLSH T1164161CC5FA85880819C8BC53F93D89D1D97F69985C78D40C08DAFBA41A783DBE83996
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2700 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211457030807926" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4504 chrome.exe 4504 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe Token: SeShutdownPrivilege 4312 chrome.exe Token: SeCreatePagefilePrivilege 4312 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe 4312 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4312 wrote to memory of 3660 4312 chrome.exe 79 PID 4312 wrote to memory of 4752 4312 chrome.exe 80 PID 4312 wrote to memory of 2700 4312 chrome.exe 81 PID 4312 wrote to memory of 4752 4312 chrome.exe 80 PID 4312 wrote to memory of 4684 4312 chrome.exe 83 PID 4312 wrote to memory of 4684 4312 chrome.exe 83 PID 4312 wrote to memory of 2836 4312 chrome.exe 84 PID 4312 wrote to memory of 2836 4312 chrome.exe 84 PID 4312 wrote to memory of 3256 4312 chrome.exe 85 PID 4312 wrote to memory of 3256 4312 chrome.exe 85 PID 4312 wrote to memory of 3384 4312 chrome.exe 86 PID 4312 wrote to memory of 3384 4312 chrome.exe 86 PID 4312 wrote to memory of 1384 4312 chrome.exe 88 PID 4312 wrote to memory of 4020 4312 chrome.exe 90 PID 4312 wrote to memory of 916 4312 chrome.exe 91 PID 4312 wrote to memory of 3304 4312 chrome.exe 92 PID 4312 wrote to memory of 4504 4312 chrome.exe 93 PID 4312 wrote to memory of 3796 4312 chrome.exe 94 PID 4312 wrote to memory of 3796 4312 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\UI\resources\app\out\vs\workbench\browser\parts\editor\media\letterpress-hcLight.svg1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fface75c728,0x7fface75c734,0x7fface75c7402⤵PID:3660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,3369675659129006841,4936987396767464353,262144 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1940 /prefetch:22⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,82497165382062890,11617406884079757280,524288 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2128 /prefetch:112⤵
- System Time Discovery
PID:2700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,2709180254380539463,4647071519099893145,524288 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2368 /prefetch:132⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,18357657354055259232,8452559735240525262,2097152 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,4191930478055243257,7172499962826181020,2097152 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,7289445483589451245,3707972368920835615,2097152 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4216 /prefetch:92⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,696365007925144883,17625599725926678104,524288 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5208 /prefetch:142⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5148,i,5752150250643442264,8267250255269101783,524288 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:142⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,1839542148620032560,12005837902760338095,524288 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5828 /prefetch:142⤵PID:916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,7019393150946499797,13323236752818189248,524288 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5808 /prefetch:142⤵PID:3304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5536,i,6686650052301248913,7016225937156696994,262144 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5428 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=744,i,2256278071837234666,16640584077980425123,524288 --field-trial-handle=1948,i,14009075519152909235,11657694991256845890,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5400 /prefetch:142⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 11631a2fbbfb43dfcb1dd5c4cc356f6bdd8ecb02858a6de76b768908e6176370
- MD5 c4557e90bc7b3a2e0256081cef1fb24b
- SHA1 b88e15edc6807a3f90cb4d0d5e27e063e9cc636e
- SHA512 13a870385e101a83e1714046b81bbdc04dcd8645b0949443984a658a8cb47fe1e02cb5c380083c3469cd1dab675a94ff1f870c0ee15e208679372317e4683a2f
- TLSH T157E0E5AEC81198270CFD172860648787EA42135B2B41485B3B3D420C8FB132B054186C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 22467854aed60e0e3cfade3ff9cff72428e63bbbefe1228bfecb68ab1e716a39
- MD5 a109a98f52bcb07124372a2fffd056a0
- SHA1 0d3da789cfd94544967ca59da884a39d9fe25b78
- SHA512 08fbee8b540235ab3410fda86fda50826fc779e50ffcdb41c0382611d4b7e334d0f3604f6199f9075efd9afcc0734197541f45c08cda27ec2978e21c81adc30d
- TLSH T14141AEF793B4957E8A1192E4EA146F2FCE790924035C7CA6C9D46E1B43F2972D10178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 354d260115748f2bb2dfff3c0d1447c1b31cbab89ce6ff48f3c357c1c3d5ac3c
- MD5 1901991ed07e8bd0673b5495474418ef
- SHA1 950db99183b37b647e0f311ca905484834f83dc2
- SHA512 f1f017c0c7ce5cfeb5bda26bdc1481ac2028a69c6cad932a97404bd98cc7232dfbdd892b81fe9f1c1234497c9bfb374449b2a13bbcd00b5522baf4c57ba447b3
- TLSH T11241AFF793B4857E8A1196F4EA156E2FCE6D0924035C7CA688D4AE1B43F2972D10178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 48337a11b83609736c243672a1602bdb398aee798d36a51a1b9292fd68ecef42
- MD5 ec15649fc5eb6c2b9dd515ca48fd643b
- SHA1 aa96fd253eb2679d645e2da9d31341234acc42d6
- SHA512 cf7c5ec796f54b986a05100bd1bbb136d88cbac92ec02e9f1e988c98d023db4b046733037747564322bf5b5704f4bff646c90e1555daff876f932b061bf844d8
- TLSH T1E741BEF793B4867E8A0196F4EB156E2FCE690924032C7CA6C8D46E1B43F2972D14178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 7a5b8d753eb0ef2a5c97a9a4f828fa29dbb650f3fa8fe784e43c49797782dd93
- MD5 12814d5e52ce51ad1a11c38097ff4c4c
- SHA1 266d6fdb7dd0513a15f03ddbaebfcc266edc67c6
- SHA512 403785fae0764b5894982573e8e2f4b9ba2a434afc48f0e709fb78d6a9a1577d59950081f0658e56dea79c14371351bf37ed7b1a37bdf980f30acd5d66b89a7c
- SSDEEP 192:GR2n0UWU7hRTv7spRPRpJka9AHsb+WNnQ/PHe2FcXavw4xrVyIsnAUgE:GR2nl7RrgDXR2wGP+2Sa5E
- TLSH T1BB52E81EB9142C7BACDAD629F925BB57E3F5203160942E88E7FC8A1C15E76CD3227017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 09f63769a0e78d3d9d9755518ebdcef11dc7778515a46c54e12bea7236ed870b
- MD5 0ad00dfe8f04455a638e9bcbea5a951c
- SHA1 9a471dbbc26043a060f6cfe178d547f0d9688e05
- SHA512 1a352442a3c788d8c6eee400b56e559e4bc3abd6ed830bcd47be260c3d544d7dcf8855ac198661bda8abe0cded5ddb69e52fcba8e9044e70d1ce373c31c3e8c3
- SSDEEP 192:GR2nfUWU7hRTv7spAPRp2ka9AHsb+WNnQ/PZe2FcXavw4xbVyIsnAUge:GR2nc7RrgUXM2wGPY2SaJe
- TLSH T16F42D72EB914387BACDAC22AFD257757E3F5203560942E84E6FC891C15EB6CD3227417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 a337f4a1befd38bf51951276a8a582ad1cad0f1c7152dafd2d792f29e2f074d6
- MD5 9600965f56c8c681f091e28fe0b4f27b
- SHA1 909268efcf3c02c2001fbcf590c52a697341e147
- SHA512 b9a1e810b783726d9254e599ae65877c641e1177651edf7ab9f5f16022ea2b81f29d498e67f6af6b2bedbbe4188c915c2338dcd812c2e239b7e58062c5f9d4b4
- SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLILcmfmnXODAH+ErU3xFH1Wmvyxotf4:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7pJ
- TLSH T162720A677C4C9E770F94CACCD8167A4FADF5025B65E9C8A583FA582903C4ACF11061EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 660eb34a427ae01be042c55ffb16612b01acf594a8dad46df365bd1f26058205
- MD5 b68b485e97f32c64a61636575333bd52
- SHA1 4d67ff4a0e7648bca277ec19fa2197babe52129c
- SHA512 6ce4d0002381fb52965dcb012a19b2527a9e22ebea20ae1d1b4cdbcdd18533fc3b6bbe7d4f5ef22752c1e551701feca1a3ea67907ce6d3d0971c29bf7f202ed1
- TLSH T11FB012508401A701C44302B4218704CC31145F14C706170253E07971D8271A1902A1A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a505.TMP
- Size 96B
- SHA256 bb6201d8daa7b8155ae6bac5db87279584e34c71a8a9727a2021b9703e0713d6
- MD5 ea07337048efe2f5c4d29c101018c801
- SHA1 9652d52deecd6449188d4e9428cce00faef2105d
- SHA512 e4d040ea11c43a2bfc27a8996245be6783be49ce937a884220feb40a6066988d924bef1dc6db3372341e09f7b5fcd5a2993b507d755e05f9464a390d4143752c
- TLSH T101B0025BC103A712C04207B03596D9DCB661EF2AC603161692E01BA6EC26BB1C72D5A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 56fbf8cb27e63cfba0a818d3084d80f875fb4c5412397f4cdd546a13156464a5
- MD5 809f1a103f5bc6cd32d3ea4ece0d9cab
- SHA1 c50434de1bb3ad6eac8967f0fcfb603ca1d806f4
- SHA512 43a5f33643c4074ad815f0675be1cd60e98d03ec22e26a3bcc3f25ecf3fc25ec979ee460b1052f4baa72b486c559b6425b1407a8fc1c536eaf9ecb17b2a28b25
- SSDEEP 1536:hFLGcP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:hdGS++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1549312B9991E7C3963AFD3E6A0079CAC4CE39CCE1514547C30C76F0E14BA392A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 e95b7663622277a0ddf1e63f405ac5d8639f066595ed821e4058e80506fceb42
- MD5 b26d8d2cde50ad456c14f39448cd165d
- SHA1 512931b10268a16f193afa6ad42580e23856f932
- SHA512 9fd8a3376fec9386864c00083a0226180660f0e0c6e31d9ad20b0775051ad47a20443d9f24d9d4c66c02c8aef466ef5cba74e0ff7a71e3162b558d4751ac1660
- SSDEEP 1536:hdLGupDP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:hVGsb++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1829312B9991E7C3963ABD6D6A0079CAC4CD3DCCE1514257C30C76F0E14BA3D2A35B8A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 f8daa51eee731461fb4b67ee41bef1bd6eb993a4dec308affdf52877d425ed40
- MD5 f3d8335ffc89ad163d3c896eb0152187
- SHA1 a2283a03bce502a83b79ccc475b492c7e7b54fea
- SHA512 a6c5b257934e21a747734e2f981fc9cdd6952c4e8f8a92c887d38f5c1b3966677f50b3e40c7023ab5d4d09d05baab9c137b42d7cf03add892c503e7298aaa26e
- SSDEEP 1536:hFLGupDP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:hdGsb++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1AD9312B9991E7C3953ABE6D6A0079CAC4CD3DCCE1514657C30C76F0E14BA3D2A35B8A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 9f60c54137e55e3b5dfef5ce8a82a427e5c979b17db8619dd402a2f18114f585
- MD5 e8b11f91806bb9af66dda2a650d201fa
- SHA1 99d72c53cac36f51d59bbbc77873d7e3dc1f69e2
- SHA512 ba9295dec6771e5add27749a8dcd1c83427a18475cca70f50e3f5bc6f635075259fe3876ed7e0604ad4a1f965f6cbcf3d6ae180793ca15eb3a8653436b12d873
- SSDEEP 1536:4LeP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:g0++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1339302B9991E7D79636ED396A0079CAC8CD3DCCE1510517C30C76F0E14BA3A3A31B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 ba2a1a9c82337daca0215473b46290200842ab67105e2c5818ba239c3a8d4a8f
- MD5 479e92a7b3d1ee08e12d5227350d179a
- SHA1 e95a5235cebb5a145f862c69cd663e8aeab6a4a3
- SHA512 421c987182b46689e145e80883953203e6f77353b674cc7224b554d862f47770f9b2b1b26d3738caedd63114049b90a28daeada68ce761935cec19b5f7fcb7f7
- SSDEEP 1536:hcLGcP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:hEGS++J3qUQm08KMWF0bFTcVHr6zgZ
- TLSH T1A89312B9991E7C3963AFD3E6A0079CAC4CE39CCE1514557C30C76F1E14BA392A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH