Overview
overview
8Static
static
1lilith_rbx...al.rar
windows10-2004-x64
8lilith_rbx...al.rar
windows11-21h2-x64
1README.md
windows10-2004-x64
3README.md
windows11-21h2-x64
3deps/clipp...Load.h
windows10-2004-x64
3deps/clipp...Load.h
windows11-21h2-x64
3deps/clipp...Save.h
windows10-2004-x64
3deps/clipp...Save.h
windows11-21h2-x64
3deps/clipp...lors.h
windows10-2004-x64
3deps/clipp...lors.h
windows11-21h2-x64
3deps/clipp...tils.h
windows10-2004-x64
3deps/clipp...tils.h
windows11-21h2-x64
3deps/clipp...imer.h
windows10-2004-x64
3deps/clipp...imer.h
windows11-21h2-x64
3deps/clipp....svg.h
windows10-2004-x64
3deps/clipp....svg.h
windows11-21h2-x64
3deps/clipp...core.h
windows10-2004-x64
3deps/clipp...core.h
windows11-21h2-x64
3deps/clipp...gine.h
windows10-2004-x64
3deps/clipp...gine.h
windows11-21h2-x64
3deps/clipp...port.h
windows10-2004-x64
3deps/clipp...port.h
windows11-21h2-x64
3deps/clipp...pper.h
windows10-2004-x64
3deps/clipp...pper.h
windows11-21h2-x64
3deps/clipp...wski.h
windows10-2004-x64
3deps/clipp...wski.h
windows11-21h2-x64
3deps/clipp...fset.h
windows10-2004-x64
3deps/clipp...fset.h
windows11-21h2-x64
3deps/clipp...clip.h
windows10-2004-x64
3deps/clipp...clip.h
windows11-21h2-x64
3deps/clipp...sion.h
windows10-2004-x64
3deps/clipp...sion.h
windows11-21h2-x64
3Analysis
- user interaction
yes - max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
lilith_rbx_external.rar
Resource
win10v2004-20260130-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
lilith_rbx_external.rar
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
README.md
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
README.md
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
deps/clipper2/include/clipper2/Utils/ClipFileLoad.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
deps/clipper2/include/clipper2/Utils/ClipFileLoad.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
deps/clipper2/include/clipper2/Utils/ClipFileSave.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
deps/clipper2/include/clipper2/Utils/ClipFileSave.h
Resource
win11-20250610-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
deps/clipper2/include/clipper2/Utils/Colors.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
deps/clipper2/include/clipper2/Utils/Colors.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
deps/clipper2/include/clipper2/Utils/CommonUtils.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
deps/clipper2/include/clipper2/Utils/CommonUtils.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
deps/clipper2/include/clipper2/Utils/Timer.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
deps/clipper2/include/clipper2/Utils/Timer.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
deps/clipper2/include/clipper2/Utils/clipper.svg.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
deps/clipper2/include/clipper2/Utils/clipper.svg.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
deps/clipper2/include/clipper2/clipper.core.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
deps/clipper2/include/clipper2/clipper.core.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
deps/clipper2/include/clipper2/clipper.engine.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
deps/clipper2/include/clipper2/clipper.engine.h
Resource
win11-20250502-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
deps/clipper2/include/clipper2/clipper.export.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
deps/clipper2/include/clipper2/clipper.export.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
deps/clipper2/include/clipper2/clipper.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
deps/clipper2/include/clipper2/clipper.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
deps/clipper2/include/clipper2/clipper.minkowski.h
Resource
win10v2004-20250619-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
deps/clipper2/include/clipper2/clipper.minkowski.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
deps/clipper2/include/clipper2/clipper.offset.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
deps/clipper2/include/clipper2/clipper.offset.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
deps/clipper2/include/clipper2/clipper.rectclip.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
deps/clipper2/include/clipper2/clipper.rectclip.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
deps/clipper2/include/clipper2/clipper.version.h
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
deps/clipper2/include/clipper2/clipper.version.h
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target lilith_rbx_external.rar
- Size 5.6MB
- Sample260511-pb32bag171
- SHA256 7f7322dad291e09fdc27a7ae31e1c3a957660311b8dea3908bfe2b10a6969ffb
- MD5 efb2df880de17801a2044abbd382c748
- SHA1 85b3cfed4f01c2673eb11525f0f44983a45b22dc
- SHA512 61b8c4312f8c11a67fcca2c827639ebbb993adc95680343d6b24c4482fb6e40efce3adcc5e6a596898522a47bd8301bcd560616d5e8c6e4f8bc3113453b83f16
- SSDEEP 98304:z1KNZcMnFO2SeBVN0iJEkG9eEf8Ez6gGtynLas9dQKpbmp:xecMo2SeObXeFEz6ltaLH9dQKhmp
- TLSH T13D563339A2BDDA051D7598E507458440EC76A38AE73CDDDB076580F0FC8467CAAEA0EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 111 5908 chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5908 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229750855264514" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4600 7zFM.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 4600 7zFM.exe Token: 35 4600 7zFM.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe Token: SeShutdownPrivilege 5348 chrome.exe Token: SeCreatePagefilePrivilege 5348 chrome.exe - Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 4600 7zFM.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe 5348 chrome.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 5348 wrote to memory of 5816 5348 chrome.exe 95 PID 5348 wrote to memory of 1084 5348 chrome.exe 96 PID 5348 wrote to memory of 1084 5348 chrome.exe 96 PID 5348 wrote to memory of 5908 5348 chrome.exe 97 PID 5348 wrote to memory of 5996 5348 chrome.exe 98 PID 5348 wrote to memory of 5996 5348 chrome.exe 98 PID 5348 wrote to memory of 4808 5348 chrome.exe 100 PID 5348 wrote to memory of 4908 5348 chrome.exe 101 PID 5348 wrote to memory of 4808 5348 chrome.exe 100 PID 5348 wrote to memory of 4908 5348 chrome.exe 101 PID 5348 wrote to memory of 1100 5348 chrome.exe 102 PID 5348 wrote to memory of 1100 5348 chrome.exe 102 PID 5348 wrote to memory of 5884 5348 chrome.exe 104 PID 5348 wrote to memory of 5884 5348 chrome.exe 104 PID 5348 wrote to memory of 3144 5348 chrome.exe 105 PID 5348 wrote to memory of 2232 5348 chrome.exe 119 PID 5348 wrote to memory of 2232 5348 chrome.exe 119 PID 5348 wrote to memory of 4112 5348 chrome.exe 120 PID 5348 wrote to memory of 4112 5348 chrome.exe 120 PID 5348 wrote to memory of 4920 5348 chrome.exe 121 PID 5348 wrote to memory of 3436 5348 chrome.exe 122 PID 5348 wrote to memory of 616 5348 chrome.exe 123
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\lilith_rbx_external.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4600
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8cf68c728,0x7ff8cf68c734,0x7ff8cf68c7402⤵PID:5816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,10806331096417635498,977322191482144921,262144 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1940 /prefetch:22⤵PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,11732856723684032899,9087364059536061992,524288 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2120 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:5908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,10222680153169530032,727723663200912426,524288 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2588 /prefetch:82⤵PID:5996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,15116257472185800741,8975602260250525215,2097152 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,16960744642998761968,14016771582395921821,2097152 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,4628399989448834966,2713245838863307574,2097152 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1744 /prefetch:22⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,7212760232882791831,4530847206182292534,2097152 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:5884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,2436138657642149894,13682244556408140852,524288 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5516 /prefetch:82⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5824,i,3324135811776173954,7812511257161624254,2097152 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5976,i,1992858603048543595,2666311902372483158,2097152 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,9918274020793894519,15996130354367534362,524288 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6088 /prefetch:82⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,14669267660116692646,7902234632398683829,524288 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5972 /prefetch:82⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,8550821771550988225,13589614242274150806,524288 --field-trial-handle=1900,i,5160316269137907431,3010969630452107863,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6104 /prefetch:82⤵PID:616
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 d1a446be7f235e117269c9dd69451ef24f186899488ce639acf8f9f2cc63477f
- MD5 293b080b80747001d432637a5820b499
- SHA1 58cf7eed45436bcdff99c1f5fca7073948951ac5
- SHA512 0f078ee05248ba05dda26c1812b6a22cdaf81b0a11ad67eb3f6b8267b8f544fa5817985243fee0f56fe3f0727b0e21709902ae468af03de67ed32dd7287c53e5
- TLSH T1BBE0E5A6C862AC2B08F91B1864144709EF0013562B41550FBA3CD5088FF023B458692C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 744B
- SHA256 557cd91d9678ec19addb96fce98c55e938c71adf162e0c3df733fa5f57d90e7c
- MD5 9fe7122bcac5d867fbf6c88c47d8b4db
- SHA1 3d3750f48c8d32eb35bcb3b1618175308544e59b
- SHA512 3788f731b2d0791ef7bf7ed064c56f460042ee2f6de39af7806cf7498a5452f9ad73cf06b78cf925b1ed37113b29c8079bc1c7cd65d2c03021c2f11440579d0f
- TLSH T112010E4D0A17CD74D3BC5B7704A01F047F6ECCFA88444B0A1EDCB0A488A70121388600
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 7f8cbee734cc61fe9afbc3a33cd766b7a6ac8f402c6c8fe2fd7b8479ebe0248b
- MD5 70a7a42d84f960d85397400e0193933e
- SHA1 03aeaf0a2fef2c62e20ba165ad3242abcdb1bf5e
- SHA512 87561d8a0002e7f072e7c99af3e636cec232e6272f784fd827d0a0decbfb94787a717b7226759ecb18bbe2355e4b23c8c0c0ef9eb66b315afb1bd556c6016e03
- SSDEEP 192:Dt3bOvJIaaIiuyt3pU5VizvetVJk7ape5:Dt3bOvJIaaIiuyt3pUvizvetVJk7ape5
- TLSH T179D1EDF7C3E8C96D891156F4AB156E1FCE2A0A14431D3C6AC8D8BE1B93F2971D21138E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 cc18afa3843453c91f884107258fc7c98492b655b92119f3748a59c744fc4518
- MD5 670fa5fc6a8795b51afc9dab5292d4d6
- SHA1 4eba5ce4a6a10325e2bc6160959facfffefa75be
- SHA512 1f2419b2a9843052f4ec676fdc9dd10043e1945a473bef1d57a1957b35dd091001d1f5b4a172686795bc687f07141be443fd38d4d191899df1de0e713d9cc77f
- SSDEEP 192:/R0cBz0hHNKmGyv7jahOPRpY1kbx9mHsb+WNYLG0lVj+Cg2g52nEao1fVyIsnAUp:/R0mz0YeaSXNIwY7I242Eao5e
- TLSH T1AE62FA6EB8246D3B5CDBD21AFA61BB57D7F0102155841E88EAFCCE2C04E76CD221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 58377af2db5256351fad94dbcddfc17b807566f6bcd45f312cefcc139c290614
- MD5 f94058931e3dde87937efebe73d5143a
- SHA1 1cd2dea2f0773abb1d7e1b7b2223a2ff37411660
- SHA512 a4f964e3f1a96a36ab9ac73438aae56daafb35d862f61aad264c08d4311e42c0f0dd44be4b1e915fca199730bf14ce9ff65e4ec627b07faf36e03a2d48652af0
- SSDEEP 192:/R0cBzthHNKmgrv7jahAPRp21k09mHsb+WNnG04Cg2g52nEaoZfVyIsnAUgtaJ:/R0mzt2Ta8XyIwxa242Eai58
- TLSH T1A752FA2EB914793B5CDBD21AFA617B57D7F4102165842E88EAFCCE2C04E76CD221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 e1cd750d241ae3c39cc9788822ec879162e253d365b8cb9bfdd696714fede5cd
- MD5 eeb30ea03d13b74caa6b81cdf62494d4
- SHA1 eac3f988189eb49b4314b1f08e2c29945f541d0b
- SHA512 a87d401bf96a74c50ad0664d30b6335ee619be9acb04dc7f201617af969d2c134e6286dcea1bed088b85c771b4e3dabdc8dad15f5e8ba2b18aa90816e4dbefe0
- SSDEEP 192:/RktnxKm2rv7jahAPRp2w9mHsb+WNnG00I52nEaoZfVyIsnAUgtaJ:/RktOTa8XbIwx0g2Eai58
- TLSH T10A42D82DB914793B5CCBD31AFA667B57D7F4102164842E88EAF8CA3C14E76CD221B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 551c60d5bfe6621bcbe951f32fa57881346474137c50bedeea3fad187b5ca508
- MD5 82c72302b875837544e063db7b3cbc31
- SHA1 1bb403d2d9af2f83568c07b4ec41832f74da4a36
- SHA512 d08b44823806839a3a458e86162049cbc558810d61e78e4da3c71c682758831109281fcee4ab9da2e2631b60b2c777f8772d9d7c83e415c21d710af6ceea8cd5
- SSDEEP 192:/R0cBzZhHNKmgrv7jahAPRp21kbi9mHsb+WNYLG04Cg2p52nEaobfVyIsnAUgraJ:/R0mzZ2Ta8XwIwYa2b2Eak5e
- TLSH T18D52FB2EB9146D3B5CDBD21AFA61BB57D7F0102165841E88EAFCCE2C04E76CD221B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
- MD5 6932e737f9fb5bb798f741f34796b7e1
- SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
- SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
- SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
- TLSH T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 eaca9b978845dd82d15e8f2160df6a73380cce4e1ce7c217e2309c0aa884388c
- MD5 589f886e251c95fc7f34fa90bd56fff7
- SHA1 e21119a23506a08228dd346a8e854c4c854d5643
- SHA512 4f867b30fbadbf3d39341d45b1831baa1c57b684d0bc9a60552297374d185e04875f4f18ad147cfeb90992dd090e289e49d5802e07d90e2281d6bc7b1d8025a3
- TLSH T12EB012518841A501C08302B422C2048C35145F109709130153E06971D8265E34514150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59355e.TMP
- Size 96B
- SHA256 54ea68ce876082219a82ff84f75ccb62380f2f51786fa3a3bffc133154518e96
- MD5 d4be68324ae1b5f2d11c52d6ebe36c34
- SHA1 4654c2af65e61abb7ee49d04d1640a70740066f8
- SHA512 59a97b7047b1ae2caf1d2f0e015c1322211f900db6d105efd17ea0ce1688b249d68761c7f6177b6dc727ff939560231df8c6334ce026586f0c3ab3db05616023
- TLSH T17BB00265C1036222C59307F0659695D87370DF39C6171216F2E01AEAFD25A715636160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 e6aa3c2485445fbe18cc5f37fa92144cec9502e3382337647b9944a132b8bee8
- MD5 f7a8ae8bad7458c0dde4bba9144d4cd0
- SHA1 bd6b20c3e30d11b67620e279dd5af6549fb7726e
- SHA512 a3cf808b4b3390a2552d989d45d9533a78a6763a10fe641223b11c622d96623256bf915d14809413143e40873a85d63f81256eed3aa803df894ac21d21eace44
- TLSH T1E5A002309784105AC1122773A581535473558A911541961745950784A9992544D23040
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 2fc16c57c0d93d53261e170c76502628c3e49ef25599e366f7244a2b6773c293
- MD5 a9d641d9f8dab03d5274f41ccf608dca
- SHA1 fa4bde111afc7e22dc1e670a17b808db3b54e487
- SHA512 fa8359ec98b9f6ea8a7b5cee410d8e56dfd238ee31c4215499e458e6faceb19060a851a273fb0c7fd46ca7e7744f8d54c11d585c803de02dad8fdad0236ad76a
- SSDEEP 1536:0cCrcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0n3Qw/xLANk0mUW5GmRntSFCjEENW
- TLSH T1519302BA9E2646EB957E469176AE7808CE13130D70AFA8CC315C639C21D41C92B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 57179b7bb4cfbf371c276f15828e6e3ff55c711d0e8d522e6d2e77866bf15c9a
- MD5 8fb17e6a055650b7317febe532662fb5
- SHA1 8e585b258f85f59108b3e258651cae10da49410d
- SHA512 a400db6f43d3d7f967552ab33da30d3561e91febef9d060c407741b1324cd9e37471e4f5ca9288f3e48805f7a72a5ee0f9ae8d4c7d6c72a202a5026bb32ca47e
- SSDEEP 6144:0hyIfzna+DALOQhYifjrOk0HOGm/SFyEEQ:0Zzna+w9KirrOjuGdF2Q
- TLSH T1981422F71E2A46FB365DC16C777FBC05C923960290DD6A8A5218939E39D90082B33B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 202KB
- SHA256 44bae77c5b7c46e8ac166a64f72966f109910b84cbdb45d442160cad8bb6bf9e
- MD5 934ab617da965da518e0efbeb3f7f545
- SHA1 7512bf2f66f79d203159f4017d4d81db3e73875a
- SHA512 5c6bacf26393465d71c10d21ecb9c0b5a4d217efc6a29dc4a863a46c84488b5842ee92226451817a2b87fc663a635dddb66a845b8071a0f5b13455177294d314
- SSDEEP 6144:0jYyIfzna+DALOQhYifjrOk0HOGm/SFyEEQ:0+zna+w9KirrOjuGdF2Q
- TLSH T1421412FB1E2A05EB365EC56C763AB805CD239712D0DDA98EA21C934D39DD0082F33A57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 8fff06e1d8d29a1a8f68e261c352b8f0d757653945c3f0dbbd20e5094657bb21
- MD5 9baac3b0bf36ff015809adbea785581d
- SHA1 60fce92a15317704ee526ded634adb7d72311804
- SHA512 56333d02429c24d417c44e82dd269717348e5076cddd74cc6ab48741474f147b53cdb39b68cb4ffe23a9e958e00ed46a95129f56eadd0840a2c140a1208650ee
- SSDEEP 6144:06yIfzna+DALOQhYifjrOk0HOGm/SFyEEQ:0szna+w9KirrOjuGdF2Q
- TLSH T1D41423F71E2A46FB365DC16C777FBC05C923960290DD6A8A521C939E39D90082B33B57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 152677.crdownload
- Size 395KB
- SHA256 132fb9564920ca7927c9be48c70b2fc0525aed61788058c26ebee08c8f19d698
- MD5 8618a5ba1b15e8bffe0b06cb5a097817
- SHA1 578d6873ce942fd5ae95bbf16fdb0f1a43677ec8
- SHA512 8ba16ff22bda652f44ec98b18d882f32fe18a17973b7b40a4eae5cbcdadebb0a6b202cd193ca1c205a9d1c0a77d24bc3f32682f3e5a8ccb23752438f4eb790ad
- SSDEEP 6144:LMB9aSNnV4MQqH4rdIPahIENrCHtLfTfuM7Djr5QpY9kSIyii35KW27c0/yW+9I:g/aElshTNrCHtLfTfuM7Djr5QpYB5aoU
- TLSH T1B8843A23F747E53BF14E0B364AE2C19165376B25A9279C63EAF4084CCF691412E3BB46
- MD5 SHA1 SHA512 SSDEEP TLSH