Overview
overview
10Static
static
3windhawk_setup.exe
windows11-21h2-x64
10$LOCALAPPD...im.dll
windows11-21h2-x64
3$LOCALAPPD...im.dll
windows11-21h2-x64
1$PLUGINSDI...ol.dll
windows11-21h2-x64
3Compiler/i...ing.js
windows11-21h2-x64
3Compiler/x...++.dll
windows11-21h2-x64
1Compiler/x...nd.dll
windows11-21h2-x64
1Compiler/x...im.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
3Engine/$R1...wk.dll
windows11-21h2-x64
5Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1Engine/$R1...wk.dll
windows11-21h2-x64
1UI/resourc...dle.js
windows11-21h2-x64
3UI/resourc...b6.svg
windows11-21h2-x64
6UI/resourc...324.js
windows11-21h2-x64
3UI/resourc...b27.js
windows11-21h2-x64
3UI/resourc...892.js
windows11-21h2-x64
3UI/resourc...ain.js
windows11-21h2-x64
3UI/resourc...on.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...rk.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ht.svg
windows11-21h2-x64
4UI/resourc...ain.js
windows11-21h2-x64
3uninstall.exe
windows11-21h2-x64
4windhawk-x...er.exe
windows11-21h2-x64
1windhawk.exe
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
597s - platform
windows11-21h2_x64 - resource
win11-20260130-es - resource tags
arch:x64arch:x86image:win11-20260130-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 07:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
windhawk_setup.exe
Resource
win11-20260130-es
windows11-21h2-x64
32 signatures
600 seconds
Behavioral task
behavioral2
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/32/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/Windhawk/Engine/Mods/64/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Compiler/include/wil/windowing.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral6
Sample
Compiler/x86_64-w64-mingw32/bin/libc++.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
Compiler/x86_64-w64-mingw32/bin/libunwind.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
Compiler/x86_64-w64-mingw32/bin/windhawk-mod-shim.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
Engine/$R1/32/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral10
Sample
Engine/$R1/32/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
Engine/$R1/32/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral12
Sample
Engine/$R1/64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral13
Sample
Engine/$R1/64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
Engine/$R1/64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
Engine/$R1/arm64/msdia140_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
Engine/$R1/arm64/symsrv_windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
Engine/$R1/arm64/windhawk.dll
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
UI/resources/app/extensions/clangd/out/bundle.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral19
Sample
UI/resources/app/extensions/windhawk/webview/logo-white.8c7b2e26389a94a26b1ffdd44cf241b6.svg
Resource
win11-20260130-es
windows11-21h2-x64
13 signatures
600 seconds
Behavioral task
behavioral20
Sample
UI/resources/app/extensions/windhawk/webview/main.00022388fd0b5324.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral21
Sample
UI/resources/app/extensions/windhawk/webview/polyfills.40a6837842596b27.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral22
Sample
UI/resources/app/extensions/windhawk/webview/runtime.6e3546d6c0e0e892.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
UI/resources/app/out/vs/code/electron-main/main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
UI/resources/app/out/vs/workbench/browser/media/code-icon.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral25
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-dark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral26
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcDark.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral27
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-hcLight.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral28
Sample
UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
Resource
win11-20260130-es
windows11-21h2-x64
12 signatures
600 seconds
Behavioral task
behavioral29
Sample
UI/resources/app/out/vs/workbench/workbench.desktop.main.js
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral30
Sample
uninstall.exe
Resource
win11-20260130-es
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral31
Sample
windhawk-x64-helper.exe
Resource
win11-20260130-es
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
windhawk.exe
Resource
win11-20260130-es
windows11-21h2-x64
1 signatures
600 seconds
General
- Target UI/resources/app/out/vs/workbench/browser/parts/editor/media/letterpress-light.svg
- Size 2KB
- Sample260420-jph1eact2k
- SHA256 c46688c88a6e90f0b48043dbb42e533097fac1a62d3b73b60083c3a2a492f589
- MD5 ae4c77285cdf81dc69ceb29d949d33cd
- SHA1 7801a805ea7bc3c4037a6843697c7050ab36b972
- SHA512 e9e6c7c78bfd96118468cc9f48d111ddd5562760b05ee0dd9377c6bc4ba1cef89bd512ade5bfaaf2363d6931e1bd024f7fdb4a64b7fa22e781006c0a39a9e28a
- TLSH T10A4161CC5FA8588080DC8BC53F53D8981D97F69949C78D51C08DAFBB419783DBE83996
- MD5 SHA1 SHA512 TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4988 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211457030712815" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 2396 chrome.exe 2396 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe Token: SeShutdownPrivilege 4916 chrome.exe Token: SeCreatePagefilePrivilege 4916 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe 4916 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4916 wrote to memory of 1032 4916 chrome.exe 79 PID 4916 wrote to memory of 4988 4916 chrome.exe 80 PID 4916 wrote to memory of 3188 4916 chrome.exe 81 PID 4916 wrote to memory of 3188 4916 chrome.exe 81 PID 4916 wrote to memory of 848 4916 chrome.exe 83 PID 4916 wrote to memory of 848 4916 chrome.exe 83 PID 4916 wrote to memory of 2208 4916 chrome.exe 84 PID 4916 wrote to memory of 2208 4916 chrome.exe 84 PID 4916 wrote to memory of 3376 4916 chrome.exe 85 PID 4916 wrote to memory of 3376 4916 chrome.exe 85 PID 4916 wrote to memory of 5044 4916 chrome.exe 86 PID 4916 wrote to memory of 5044 4916 chrome.exe 86 PID 4916 wrote to memory of 3048 4916 chrome.exe 88 PID 4916 wrote to memory of 756 4916 chrome.exe 90 PID 4916 wrote to memory of 2444 4916 chrome.exe 91 PID 4916 wrote to memory of 4236 4916 chrome.exe 92 PID 4916 wrote to memory of 2396 4916 chrome.exe 93 PID 4916 wrote to memory of 1100 4916 chrome.exe 94 PID 4916 wrote to memory of 1100 4916 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\UI\resources\app\out\vs\workbench\browser\parts\editor\media\letterpress-light.svg1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3d58c728,0x7fff3d58c734,0x7fff3d58c7402⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,8797540723395546374,11200602499358164743,524288 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2136 /prefetch:112⤵
- System Time Discovery
PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,16672385309576386801,5460288234899481446,262144 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5126101601872959135,405969886627717880,524288 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2520 /prefetch:132⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,13633721628181576239,15334024397185346443,2097152 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3080 /prefetch:12⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,6917433241724428987,7012869255930776564,2097152 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3088 /prefetch:12⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4184,i,17494877328093385530,17577862969958217266,2097152 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4188 /prefetch:92⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,12592900606126395420,10532331600717873954,524288 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5360 /prefetch:142⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,13484420301870587912,2380207568461319737,524288 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5384 /prefetch:142⤵PID:756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,3067300888177027298,17524752576780855384,524288 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5648 /prefetch:142⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,9132174995379148452,6660358558227054997,524288 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5592 /prefetch:142⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4200,i,7044956270568810151,15600068900313565835,262144 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1508,i,8158782462743675744,11397595965604492220,524288 --field-trial-handle=2024,i,3123837875824524033,12797009315854760124,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4236 /prefetch:142⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\92cec91b-09f3-427e-8e53-f43d7e0554a6.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 83fb3ae279cbae52665e9f11072bf6257c048c630bc11d9be15f145743be7280
- MD5 bee3272dd2cc4bf11904c80099aa9949
- SHA1 3a0ed9ede53f3fe69cad94df0d916be0d2ed7535
- SHA512 aa7517f198031ac156d4e10d25b123b166f9a0e62d53727fd68b3a251cd7ced60b8a376d199fb695aaa38835ccf9ca5299d8ce5c69779dbbb0f38930679ce918
- TLSH T180E02BEED921D82708FD076960544B47FB21135B2B80484F3F3D810C4FB062B0AC586C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 a7ee84ec197823e312df9e97bb5ddba9c75581e40462a1024ff92a207227b133
- MD5 c09efd3cc1d17422c726165b727f22fb
- SHA1 1c7685c92f3bcb017147143644e4b9472951afe1
- SHA512 c5731ca33703309dc7e96651b412ef70e8ae6bc9e792cd6195c6f43bd666bc1e80f7030305fc128ed9918fe60f62552d47be05fc9e8300ed3f5893a554053a65
- TLSH T16B418CF793B49A7E851196E4DA146E2FCE7D0924031C7C62C9D4AE1B43F2973E20178E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 23e7bf08d373163fdf8ba0c494ee6e9691b778ec2d527f884d74549d160a6b94
- MD5 f54dbced8969d97e374e4ed659444934
- SHA1 a20b915d5db9d4740c9e16cc510a617d4a053a45
- SHA512 429d4db2affda3cb531952f749d884da4e64d1097c10f22c0d466e795beaed881182381ead7542e9f488e1289108882685c4b7716dbe18a5da1f3948f42ca6a5
- TLSH T1ED51ADF793F4C97D8A0196F4EA156E2FCE790924031C7C6289D4AE1B43F2972E24078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 c76edab4105085475e105dd1bf423f7070c20815b4c37823dd8700019ef334f4
- MD5 3ff04a9e156b00305efb305f1cd98d2a
- SHA1 45991d9bb771975ab03a41139b1dcf5943fd3314
- SHA512 dc2175cf82efccadf25f06aeff46eadbb281f08b33b09f6872c69e2e8af21ce0a6bdbe630dc0d5428972233436e0fdb843533aafa04dae7159c68afb2d761ce1
- SSDEEP 192:2RqHfOludTev7ApAPRp2eg9qHsb+WNnTbPpPNIMaIHOtVyIsnAUgE:2RqH9asUXY4wPPPRazE
- TLSH T18242E72EA918393B9CC6C619F961B757F7F5106521942E88EBFC8A1C11E7ACD212B027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 54691d7eb9924017ebe631456d3fd4c3c320870ffe29e9cace7ab450074fcf14
- MD5 533980c931abff34ef1dde25ea882273
- SHA1 411b4ed890aed0e45749298d24e42e1a4103b99d
- SHA512 dd315cb2bcdec3a709f8469dde30e08e59e9c8d153e4dfde71df38365ab9ecf834c2b50400e726d0ccad0adaf86793babcc1ade115d447b83fe98d0241d1b301
- SSDEEP 192:2RqHWkOludTev7Ap3PRpLeg9qHsb+WNnTbPjPNIMaIHwtVyIsnAUgE:2RqHWAasFXn4wPPBRaPE
- TLSH T1B052F92EA908293B9CC7C619F961BB57F7F5107521942E88EBFC8B1C15E7ACD2127027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6980acb48390452becc731f13247a06db7e3f675dd76546a03c371433c3ec147
- MD5 12c7b9639a39694a5cb1d858d8b05c09
- SHA1 b2417e0bdabf0fe31afe1fe8278915ca3d18915b
- SHA512 e3cdc085372e14fab718b823411d394231095620c09746f2fbdc735e28310f5e6bad7e6b119af7c13e2b67bed55c9c34d27a33bf3574fff9376ec950a2087cb7
- SSDEEP 192:2RqHnWYudTev7ApAPRp2eg9qHsb+WNnTbPCPNIMaIHgtVyIsnAUge:2RqHWFasUXY4wPPiRate
- TLSH T19442D92EAD18393B9CCBC629F961B747E7F5106530942E88EBFC861C15D79CD612B027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 634a62e5c1c96bdd791ff07305ab62a8d8660481596bdbe1a7bcc487673e8583
- MD5 716b8b793ef7479278378a26dcb5c9a1
- SHA1 7c069746cde1d516e34396182653111a4a286af5
- SHA512 d99550aa822873651f7b3245b762657383be1baa3bde71ce06b8a07805ff614078dd3e23cb2b92cf102c4f04d931d1db0d7f569e804b9b6956a072594e9786b2
- SSDEEP 384:2Mjqt7KxkXqKf/pUZNCgVLH2Hfgslo67pLILcmfklXODqt+ErU3sgH19TD59al2X:2Aqt7KxkXqKf/pUZNCgVLH2Hfgsq67pm
- TLSH T14F72F9676C4C9D7B0F94C68CD82A7E4FADB5021B65ED886443FA582603D5BCF110A1F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 fca54f7afc35433769cf8d5a4c9a5b192f3cd7461e782d1501f81ed8fbd25363
- MD5 037ed7a7c1c802694eb818bf8873a055
- SHA1 a246970e8488f5ed69693cf3c95a10875cff6bb8
- SHA512 1b1562fe786367424b93853244f49f7e4ba35c6a401228ff7a254b6d031dbc8512135be07a07a198d5221d4e90cb342f048adb9ea51dd9d56b9170047888d819
- TLSH T1BBB012908181D601C00303F4258F0498312C9F118705130153E06EB198273A14118151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586c13.TMP
- Size 96B
- SHA256 79553454d50130b9cae242ec91a09d3c51a3f26c8c6760ba62f4d33e14fd2993
- MD5 6abb5236891430bfe01b11d31406229a
- SHA1 798f4135303c7129f00bbca5fd72d382931119b7
- SHA512 f8d609a75f91f0e3dd0c09f0f418ab8991be4c6869ba05e9ad0a7697e9fb683ebe16ce655f08d387dcb573e8695da877d8a4314c8f82d0b885a11f928d1c2354
- TLSH T132B02208C002B383C00303B0388283C8B0A0CF30C223032282E00F22CC282A0202C0A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 1d1776c6d33cb593ae82209fbba260ce8a46f2673d59e54dc3dc663f4c97494b
- MD5 330dfdc25bab21cdbf1047ea59657006
- SHA1 37d4a83f3814294c2cccb9514dd960f26b00e41f
- SHA512 b1319e35b01737be51f26e57bb7b111ad6a50151fd08f1b1ae6a50084a1acef4aeaab0b61ed840c9a526cfe25cac89d3a35cc3bd263bdaa2bccfea9508dfc483
- SSDEEP 1536:7QryP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:y4++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T1029312B9991E7D3953ABD696E0079CAC4CE38CDE1518647C30C76F0E14BA393A34B8E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 7f8af7a965fb018e70d74ad157feaa37a2c105331e4f34736905d18882e500c1
- MD5 f5260d5466ac98b94b24d15b480bb694
- SHA1 8394d308cbf91f0acd45a5eeb7f0ea8be61153d4
- SHA512 619cfec353f0b749353ef3bd546dcca0ca4c7cd2fe8f86b69495d0a3be2b621dad6e0c279ac85a8d41c83adb61c233bfec1810b0664ef631bf3cf3183e4a1d61
- SSDEEP 1536:DQryP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:K4++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T1E09312B9981E7D3953ABD696E0079CAC4CD38CDE1518647C30C76F0E14BA393A34B8E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 a1146bc12923122657be3d4d57c70a0a7da0bee256ca085c3b945579f7a06cad
- MD5 406df88b4adeb0ec4593c97547fde592
- SHA1 b65c0058d4f7738eaba9336204b4d44e315ebe8d
- SHA512 f04b7110ae8a8323841141b6ee73f38ef39117750b51ffb8fb7fead0398da5bee77c781fbc2bc2bab991bb0fb28e27e2f0d1e246f41020fc7c95debb228df71f
- SSDEEP 1536:KQqvP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:g++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T18A9312B99C1E7C3963ABD2A6E0079CAC4CE398DE1114557C31C76F0E14BA393A30B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 e2bedd5f6cf3262ad876c88b68c6601fca8ea164f537333c0ffa82d8954a4606
- MD5 1ae1dd54613f3f16c026453a630ab66b
- SHA1 4394a6b85dc32ee8512f2798fa87dd676e398fb9
- SHA512 d7aa2bc5364603cb11a464bff56ab71adaab829309bd5038ab7a6f3147dab28e565f15e3ae89ca206277196857b88e325b87fd868aa8d747336163bf13339ca3
- SSDEEP 1536:DQqvP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:f++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T17A9312B99C1E7C3563ABD6A6E0079CAC8CE398DE1114557C31C76F0E14BA393A34B8A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 388afc6e3dee17eeb916b17f996b800ec40441fe5c7a24e2a74e8d7807afc2c7
- MD5 7f0fdfd46e68d0b70da005e9ad662445
- SHA1 f8d88f93232e49ebcaf2678cdf4f450aa9c39519
- SHA512 5778c48dbe6232bf6f23a5e473c6e14ce9021a76665fe007bb47ca85dac09dbdd0ec4d886b1a32f3ba67ec5544e5b6c104eed54b9a1ddc0a43579ebd444f3352
- SSDEEP 1536:hZRP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNs:B++J3qUQm08KMWF0bFTcVHr6zT
- TLSH T1C89312BA591E7D39536AC296D0079CAC8CD3CCCE1514557C30C7AB1E14BA393A30B8E5
- MD5 SHA1 SHA512 SSDEEP TLSH