Overview
overview
6Static
static
1URLScan
urlscan
https://www.twitch.t...
windows10-2004-x64
3https://www.twitch.t...
windows10-ltsc_2021-x64
4https://www.twitch.t...
windows11-21h2-x64
4https://www.twitch.t...
android-10-x64
1https://www.twitch.t...
android-11-x64
1https://www.twitch.t...
android-13-x64
1https://www.twitch.t...
android-14-x64
1https://www.twitch.t...
android-15-x64
1https://www.twitch.t...
android-9-x86
1https://www.twitch.t...
debian-12-armhf
https://www.twitch.t...
debian-12-mipsel
https://www.twitch.t...
debian-9-armhf
https://www.twitch.t...
debian-9-mips
https://www.twitch.t...
debian-9-mipsel
https://www.twitch.t...
ubuntu-18.04-amd64
6https://www.twitch.t...
ubuntu-20.04-amd64
6https://www.twitch.t...
ubuntu-22.04-amd64
6https://www.twitch.t...
ubuntu-24.04-amd64
6Resubmissions
10/05/2026, 14:29
260510-rt2bjsav5v10/05/2026, 14:28
260510-rtcyysdw9p410/05/2026, 14:21
260510-rn53jsdw8m6Analysis
- max time kernel
900s - max time network
901s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
10/05/2026, 14:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.twitch.tv/tiedplays2
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral2
Sample
https://www.twitch.tv/tiedplays2
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
13 signatures
900 seconds
Behavioral task
behavioral3
Sample
https://www.twitch.tv/tiedplays2
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral4
Sample
https://www.twitch.tv/tiedplays2
Resource
android-x64-20260325-en
android-10-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
https://www.twitch.tv/tiedplays2
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
https://www.twitch.tv/tiedplays2
Resource
android-33-x64-arm64-20260325-en
android-13-x64
2 signatures
900 seconds
Behavioral task
behavioral7
Sample
https://www.twitch.tv/tiedplays2
Resource
android-34-x64-arm64-20260325.1-en
android-14-x64
2 signatures
900 seconds
Behavioral task
behavioral8
Sample
https://www.twitch.tv/tiedplays2
Resource
android-35-x64-arm64-20260325-en
android-15-x64
2 signatures
900 seconds
Behavioral task
behavioral9
Sample
https://www.twitch.tv/tiedplays2
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
900 seconds
Behavioral task
behavioral10
Sample
https://www.twitch.tv/tiedplays2
Resource
debian12-armhf-20260126-en
debian-12-armhf
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
https://www.twitch.tv/tiedplays2
Resource
debian12-mipsel-20250619-en
debian-12-mipsel
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
https://www.twitch.tv/tiedplays2
Resource
debian9-armhf-20260127-en
debian-9-armhf
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
https://www.twitch.tv/tiedplays2
Resource
debian9-mipsbe-20260126-en
debian-9-mips
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
https://www.twitch.tv/tiedplays2
Resource
debian9-mipsel-20260127-en
debian-9-mipsel
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
https://www.twitch.tv/tiedplays2
Resource
ubuntu1804-amd64-20260126-en
ubuntu-18.04-amd64
8 signatures
900 seconds
Behavioral task
behavioral16
Sample
https://www.twitch.tv/tiedplays2
Resource
ubuntu2004-amd64-20250619-en
ubuntu-20.04-amd64
8 signatures
900 seconds
Behavioral task
behavioral17
Sample
https://www.twitch.tv/tiedplays2
Resource
ubuntu2204-amd64-20250619-en
ubuntu-22.04-amd64
8 signatures
900 seconds
General
- Target https://www.twitch.tv/tiedplays2
- Sample260510-rn53jsdw8m
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1812 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134228965089806825" chrome.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 1028 chrome.exe 1028 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe Token: SeShutdownPrivilege 3672 chrome.exe Token: SeCreatePagefilePrivilege 3672 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe 3672 chrome.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3672 wrote to memory of 4992 3672 chrome.exe 83 PID 3672 wrote to memory of 4448 3672 chrome.exe 84 PID 3672 wrote to memory of 4448 3672 chrome.exe 84 PID 3672 wrote to memory of 1812 3672 chrome.exe 85 PID 3672 wrote to memory of 4604 3672 chrome.exe 86 PID 3672 wrote to memory of 4604 3672 chrome.exe 86 PID 3672 wrote to memory of 480 3672 chrome.exe 88 PID 3672 wrote to memory of 4156 3672 chrome.exe 89 PID 3672 wrote to memory of 480 3672 chrome.exe 88 PID 3672 wrote to memory of 4156 3672 chrome.exe 89 PID 3672 wrote to memory of 4940 3672 chrome.exe 90 PID 3672 wrote to memory of 4940 3672 chrome.exe 90 PID 3672 wrote to memory of 4876 3672 chrome.exe 92 PID 3672 wrote to memory of 4876 3672 chrome.exe 92 PID 3672 wrote to memory of 228 3672 chrome.exe 93 PID 3672 wrote to memory of 5048 3672 chrome.exe 102 PID 3672 wrote to memory of 1068 3672 chrome.exe 103 PID 3672 wrote to memory of 4700 3672 chrome.exe 104 PID 3672 wrote to memory of 1028 3672 chrome.exe 106 PID 3672 wrote to memory of 2768 3672 chrome.exe 107 PID 3672 wrote to memory of 2768 3672 chrome.exe 107
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.twitch.tv/tiedplays21⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcec8dc728,0x7ffcec8dc734,0x7ffcec8dc7402⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1764,i,8160214079903724015,9443454972592902677,262144 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1932 /prefetch:22⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,10171942537922719146,10150410786803099401,524288 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2296 /prefetch:32⤵
- System Time Discovery
PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,6754411720108751975,8309995221234891994,524288 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,7560842249051776394,15435187240858446259,2097152 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,10031002441296882726,10519626426565367458,2097152 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,190357312391545142,8786561880573320699,2097152 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4296 /prefetch:22⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,18221973418410767025,15341163752130234909,524288 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4776 /prefetch:82⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,1690910664546421281,15801510364656721727,524288 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5956 /prefetch:82⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,8607529684671674061,17025736999824876367,524288 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5412 /prefetch:82⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,2420200504299767236,13808215624298340463,524288 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5392 /prefetch:82⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,15665056141636142266,10403871500873916465,524288 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5952 /prefetch:82⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5168,i,3334775988189906625,15060251926264881953,262144 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,13818281487969975362,6785198017632004631,524288 --field-trial-handle=1940,i,10119675920992124514,18325120684430145832,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6032 /prefetch:82⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 378813c663bb1a4cba06cfbe32a46f2b571bb7c9e50cd36206026ca91d30f563
- MD5 e33eb945195b774077aeea2a33ea4543
- SHA1 64609992aaf4b4d067ca96bbe9a5b5718846020b
- SHA512 08bd2f3389cad9d92a5591028a9193371a15f184861583274ce5580d1a745fe3618309ca227abbf27c2443c2a1c51ed3883c9214610555d346cb018ae8c1a1c3
- TLSH T102E02BEAC931E93749FE0F1861508B46EB4013573640486B763DD2094F7427B169685D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 6KB
- SHA256 96ecb8552402fc5ecca27c55ccea99a1d009d1dd9c6d6a86b7b9158d2ba77d69
- MD5 8fef2894a766905aaf86b1f0d43bb3ee
- SHA1 5bf3687dfadd41e587a9390e59d6d79fbe5e7d0a
- SHA512 6a5b1653c9694addfa1d7c0a90db72d5dc0b7d24f515773b4292f694f5f997b7975181b17a19cefae838780d8a2e431cbd9720464c6a4c1524c8936861a2567c
- SSDEEP 192:dPEN13sNnZFoTdjD5oqJxLTNX5a85ans60+NhmzzeKCIMaJOTPU+CDYOhGGqvk6e:dPED3s5ZFoTdjD5oqJxLTNX5a85ansYQ
- TLSH T1C4D11DD958D82E09FF71B67444F2AF06B032714A999B5FAB0B06403A2837FF68142DC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 6KB
- SHA256 8d9ea8fd44bc9567f002b22bc0809c1d88f5c10cdd1d369f0dc542663c4a82d0
- MD5 6c538acc8e123817f0395e4bc373d8cc
- SHA1 a5217b3757c7346db9015f9787e3c225154551ea
- SHA512 4b951f162f731939ba69a42f79a42254ed2122a9733d23063bc0c34e2c59910287077f6ab461420991a4933559a83f02be0b0bcd5bec58db10069c2137f9ebbc
- SSDEEP 192:OoBgQmnUoT55bUTaIXPobq/+K4j4OmMcOdmPcKYdjzDwkWqVRpEhc3nGLMROF+Yr:OomQAUoT55bUTaIXPouGK4jtmM/dmPce
- TLSH T174D131D818D81E49FB31B77440F2AF12B033754B9A9B5FAB1B06403A2836FF68102DC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 a5bc0f277c3d763ea138d4b9249080f7f5406756262c0376aec4ec0008457f0f
- MD5 a2d6caa6f4eae50085a3c453d25a51c8
- SHA1 3022470310cb5d24f4e149b0e22daf148479f1a7
- SHA512 6301f7874d5c2d91db20c27ea805ba58de6fbfe9c59201382ed341b224423e081ef30361512afde95d4faafa7b502cf847da832ea94b5ac622a0dfeef007bbe3
- SSDEEP 96:D6wMaIaEg7k0itR/AwYFHH5bffFLnHJjhn35U6GG:D6wMaIaEg7k0it1AwYFHFfFLnHJjhnJD
- TLSH T107B17AF793B4863DCE2295F4EB056E1BCEA80524431C3DB9CAE46E1757E2971E20474B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 51c14c77922b6f83ecb2ae626fe115349e8080468eac758b6adc6b351b1e895b
- MD5 4de34e5decda6cbe074d7b96e26a316b
- SHA1 1dede51f9b56ec49ec4e830b0fd079f77ec5a607
- SHA512 7bf0109664b7577dd5f593b0e85385bd99bef1d5e8ccc8fb153ee631a45872b37c234104219518af4abc2fb722087d4162db81cd3a41efca2176cbdde01febcc
- SSDEEP 96:DUNQaIaEg7k0itR/vwYFHH5bffFL3qHnHABlGG:DUNQaIaEg7k0it1vwYFHFfFLaHnHwlP
- TLSH T14DB188F793F4863DCD2296F1EB196E1BCEA80924431C3D69CAE46F0757E2971E20474A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 994b2b93b645b16ffa7ccf1635bdcf6cfc4a3408b603d7c4d49024e8520e1cfa
- MD5 7c412423f15ba1e398f21add365bd0e2
- SHA1 b18d8ae2644cb3c46d771633510c3273f0d77155
- SHA512 f7c40383fa8cddb4f4df3bbb3f5b53cd82d279b76e61e7aa0073bae116add9ee4af113d90b743315e1a889e04d871f250c000f685678590a520f13b13e443f8c
- TLSH T18811596BD26F7817513D4D6B6E15BC0A697AE43243C1A0F0DEEA817DB085DF32B22013
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 62ba8e591dc680251f12938f077cd300b92c5d24af967dc2c8aeeaee9551540e
- MD5 104038abeee50d175dea22bc93a3f096
- SHA1 f2cd4016c5f7e5f004b2c206d6f3a5fb0883f8a1
- SHA512 f2ae06986fd40ce64da9e7acfd720011f28a692c4560d94f654d5cf980daf004fab01ed39759af6871d7e58ec6b5e72a55acebd918201e148407c321a1524e1e
- SSDEEP 192:6RtY12qg3Gcv74npAPRp2Db9GHsb+WNnCgOQf2QDna7eQQAVyIsnAUge:6RtY17lIEnUX0kwtV2oa7De
- TLSH T1CA42F62ABD18B47B9CCBD219FAA27757D3F5103520A02E84E6FC8E1C14E79CD621711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 c5a22907a0f96e1662e35d6a2c7a69f15e7caf3dc7dd79a6ff673e8d63f58cd4
- MD5 c60a89e8fec55e2f29a16abb97f13c46
- SHA1 7909be924542d0e4e5f05780bf035f5e3c8d7583
- SHA512 a4e42b1677df891fb6b014e607b45b5dd0725c7a09e06b7ce1163a98c8ed89c3b2f690709434a3abf6526cc1117595ea139075cff79ea61f484a98cd25414b02
- SSDEEP 192:6RtY14qg3Gcv74npPPRp/Db9GHsb+WNnCgOUzwBDna7eQQkVyIsnAUgE:6RtY1JlIEn5XXkwtxwxa71E
- TLSH T18352182EB904B43B9CC7C219FA617B57D3F5103621A02E88E2FC8E1D14E79CD6213117
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c8b35b3777ce326ef940c17cce6ef24e174b8891c7550fc3682e57a55e265a8c
- MD5 d5fc06adfa3081a89a46beb8858f9b99
- SHA1 420cb6a7ba8d4c57e5541073c66af9a2ab1c97ea
- SHA512 0c4cfb344a2d0f0bcf4f414ef590ebc1a825188405880d886427ffa242f6a6c7ee79c37472bcccf8bc5fb7562740730ab2129b887be57eb29857ef3659b4167d
- SSDEEP 384:zZj/y7KxkXqKf/pUZNCgVLH2HfgslKn7pLuLcifd4XOD/W+ErU3bVHGzur5Rg:zp/y7KxkXqKf/pUZNCgVLH2HfgsUn7p3
- TLSH T17472F9A76C4CDA370F94CACCDC26BA4F9DB5014B65EDC86483FA981903D5ACF110A2E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 605c44a90f6cedc4d42b05381e4e91c1c4bf16c0e19d0c1033052a12ca03f3db
- MD5 0324ab33d28aa93ae5024a01126bd621
- SHA1 a6d6749de2a931806fadcc44b782060f15dbbff8
- SHA512 fb22623705e7121dcc8321771facc0cad0039f4574ddb8845e470c98daba73d10f99ceb5e71f024f4ea23edbe946504bdefdf1158a8bbd93d31480ac0b11b52a
- TLSH T146C012E1C505B6A2C09607F02092A8BC3D14BF30EE07174A5BE51BB6EC3552241562D1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5871b0.TMP
- Size 96B
- SHA256 74810307eb6f4597881974bab0438b61801deaca314cfc89c6994ddbe67743ce
- MD5 d53c32b44eab3cb039b7106208eb2f34
- SHA1 d7097df1abfb8c8acc4c0485ed10030fe1c6948a
- SHA512 ceb249bb4ca53a9b3dae0987591eac772d1dd8e0abb4987f69c4ec105467ce4516e10c91739974cbd761d74391e3a8fcf7ce5a4e8f19ee7618b313620b2e567d
- TLSH T142B02200C002222AC08203B820AAC0E83030CF30C3030303C2E00E2ACC2033000208E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 9af7eb4c6dc07fd68375aa338adb2204616b1cbe460ef93fb6f7458ed95b3206
- MD5 9376edc48c2d4a04863ffbb0efdc6f4e
- SHA1 4a8286718682e49cd5362f226dc9478eed37d1b4
- SHA512 361bcb91c22fac12f7c7b8c5e77a3645c2edb7846af276b96a9575dacbe4c60c643120ece8315cd4bf77319895ee279bfbcc2a6745a97f11859ce081a05abb56
- SSDEEP 1536:MhKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPk:GDlBshIZZwINsIrS2uJBLpAkLQqk
- TLSH T14C9302B73EA6EC73C59C4102A93C2A4D6AC4F5E9C829F67658CA673F41F1BF99103112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 6d0899e4b2e820ec6636951d2f0bd4441a3437ddbbe097d74bbe99f0fb5bccff
- MD5 94145f4c9e1cb9f05529b5dd900dad0c
- SHA1 7f30849bd1ebaa364ce6d01c1d56732764883419
- SHA512 1b48a1d6fa940b89a0d017b0b0314a61f60bf51aba1b62cd0c3de01691994b8fb74111fd5e8346d16b9ceab5bc998fd03c016cd3442115a406f9269d9a7d9bec
- SSDEEP 1536:JnKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPk:NDlBshIZZwINsIrS2uJBLpAkLQqk
- TLSH T1129302B73EA6EC33C5EC5102A93C264E2AC4B1EAC918F57559CA673F01F1BF95243112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 578afd91c02b1631c68be9c6038c44fb9c2cd625b35af2890a3b8ef1a82717ca
- MD5 78e055f64f28dc8712b1e72aaf31159f
- SHA1 052981f00e544bd74c56a2fd63ce49927fd39d23
- SHA512 a5b61dd8355d9ec5f04de7806a2737cbc73e052c7ee685366aedf168bfa9d4a47732fe0a3a8336c6650fb372a11fd6de33519ce3d58ba5501c5a9f5ffb070fa0
- SSDEEP 1536:MnKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPk:4DlBshIZZwINsIrS2uJBLpAkLQqk
- TLSH T1279302B73EA6EC33C5EC5102B93C264E6AC4B1EAC918F97559CA673F01F1BE95243112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 e579c91caf2cd7e54c074a349a56055a91a1975e72152301a8b46a6d44df8f0a
- MD5 3549d78d8ff0a32b41587c346a825a3c
- SHA1 5bab02dca8837bce2e2b0100afafc0d34dfbe6d7
- SHA512 64cfe5fc0a49ff04cedc9fca697623b67fcbfb60ce685e9dcefea8d10c666862fb04a9f856f1bd910c7d1ab274750d24185cebecee00dcd97af65e2653734737
- SSDEEP 1536:gOWKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPk:DWDlBshIZZwINsIrS2uJBLpAkLQqk
- TLSH T1529302B739AAEC77C9DC1102A5382A4D2AC4A1EAC91CB57559CA6B7F00F1BED9243112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 2a3d8c4c4c83eb0982ae8c266cc4cbbc6ae5c77566bbd90cc7c4f58875a82dbe
- MD5 fb754d24d7cf5617c488bd709f2a8165
- SHA1 57b4e30d4bd36fad3cdea0518970cbf50e1ae840
- SHA512 96b76f207194c3676fe102d198163cf59fe2e69a2d02f9e61549f12f939d87b262ac2624577da0eac452e20462c5c4c7edf1cda6154078042c2037915c39f34d
- SSDEEP 1536:MOWKWlBshIZW8wI/Yc5hJxedCj/S2uJYgtLaEmNsXtZdzqRatPk:vWDlBshIZZwINsIrS2uJBLpAkLQqk
- TLSH T15F9302B73DAAEC77C5DC1102A5382A4D2AC4B1EAC91CB57559CA6B7F00F1BE99243113
- MD5 SHA1 SHA512 SSDEEP TLSH