Overview
overview
10Static
static
5RoleX-BootV2.exe
windows10-2004-x64
10local_bin/...PO.dll
windows10-2004-x64
7local_bin/...PO.dll
windows11-21h2-x64
7local_bin/Qt5Core.dll
windows10-2004-x64
1local_bin/Qt5Core.dll
windows11-21h2-x64
1local_bin/...-3.dll
windows10-2004-x64
1local_bin/...-3.dll
windows11-21h2-x64
1local_bin/...-1.dll
windows10-2004-x64
1local_bin/...-1.dll
windows11-21h2-x64
1local_bin/...40.dll
windows10-2004-x64
1local_bin/...40.dll
windows11-21h2-x64
1local_bin/..._1.dll
windows10-2004-x64
3local_bin/..._1.dll
windows11-21h2-x64
1local_bin/...47.dll
windows10-2004-x64
3local_bin/...47.dll
windows11-21h2-x64
3local_bin/...v2.dll
windows10-2004-x64
3local_bin/...v2.dll
windows11-21h2-x64
3mpclient.dll
windows10-2004-x64
10mpclient.dll
windows11-21h2-x64
10presets/DDSPreview.py
windows10-2004-x64
3presets/DDSPreview.py
windows11-21h2-x64
3presets/FN...hes.py
windows10-2004-x64
3presets/FN...hes.py
windows11-21h2-x64
3presets/FNISTool.py
windows10-2004-x64
3presets/FNISTool.py
windows11-21h2-x64
3presets/FN...set.py
windows10-2004-x64
3presets/FN...set.py
windows11-21h2-x64
3presets/Fo...ker.py
windows10-2004-x64
3presets/Fo...ker.py
windows11-21h2-x64
3presets/ch...is.dll
windows10-2004-x64
1presets/ch...is.dll
windows11-21h2-x64
1presets/di...ic.dll
windows10-2004-x64
1Analysis
- user interaction
yes - max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/05/2026, 04:29
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
RoleX-BootV2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
local_bin/EqualizerAPO.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
local_bin/EqualizerAPO.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
local_bin/Qt5Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
local_bin/Qt5Core.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
local_bin/libfftw3f-3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
local_bin/libfftw3f-3.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
local_bin/libsndfile-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
local_bin/libsndfile-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
local_bin/msvcp140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
local_bin/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
local_bin/msvcp140_1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral13
Sample
local_bin/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
local_bin/temp/d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
local_bin/temp/d3dcompiler_47.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
local_bin/temp/libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
local_bin/temp/libGLESv2.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
mpclient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
mpclient.dll
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral20
Sample
presets/DDSPreview.py
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
presets/DDSPreview.py
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
presets/FNISPatches.py
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
presets/FNISPatches.py
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
presets/FNISTool.py
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
presets/FNISTool.py
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
presets/FNISToolReset.py
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
presets/FNISToolReset.py
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
presets/Form43Checker.py
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
presets/Form43Checker.py
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
presets/check_fnis.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
presets/check_fnis.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
presets/diagnose_basic.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target local_bin/msvcp140_1.dll
- Size 23KB
- Sample260525-e39ytsa15r
- SHA256 2c03cf78553689ca0523a3ef7c3161939b8f4a2fe246d9e90efa9cfef95c59a7
- MD5 6d0a35401a239a046dc2a43777b01a30
- SHA1 0d7070f9abaa911f636cad4f0d5bf8a3445a9e6e
- SHA512 9554ffb6d87aa25bc80bc56ddc46a5f310fe0cdbd4dd1ba412c58c4f103be55bd96dc76652c39865f662118df5853fc3d2886a7c02b4e156eb31d5abd7f1cc59
- SSDEEP 384:IXt9apR9zFzN2WWcZ5gWc/14gHRN7eDH24rlGs8:IXK79zFzEqQeT6
- TLSH T1F2B24B86FB284843F866543082A6DE07BA3DB3D59B2193DF1361E75D0DE37C1AA35A18
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4764 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241570559349937" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe Token: SeShutdownPrivilege 3884 chrome.exe Token: SeCreatePagefilePrivilege 3884 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe 3884 chrome.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3884 wrote to memory of 4072 3884 chrome.exe 104 PID 3884 wrote to memory of 4164 3884 chrome.exe 105 PID 3884 wrote to memory of 4164 3884 chrome.exe 105 PID 3884 wrote to memory of 4764 3884 chrome.exe 106 PID 3884 wrote to memory of 4168 3884 chrome.exe 108 PID 3884 wrote to memory of 4168 3884 chrome.exe 108 PID 3884 wrote to memory of 472 3884 chrome.exe 109 PID 3884 wrote to memory of 4656 3884 chrome.exe 110 PID 3884 wrote to memory of 472 3884 chrome.exe 109 PID 3884 wrote to memory of 4656 3884 chrome.exe 110 PID 3884 wrote to memory of 4832 3884 chrome.exe 111 PID 3884 wrote to memory of 4832 3884 chrome.exe 111 PID 3884 wrote to memory of 4708 3884 chrome.exe 112 PID 3884 wrote to memory of 4708 3884 chrome.exe 112 PID 3884 wrote to memory of 5048 3884 chrome.exe 113 PID 3884 wrote to memory of 5048 3884 chrome.exe 115 PID 3884 wrote to memory of 5048 3884 chrome.exe 115 PID 3884 wrote to memory of 1760 3884 chrome.exe 117 PID 3884 wrote to memory of 596 3884 chrome.exe 118 PID 3884 wrote to memory of 2492 3884 chrome.exe 119
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\local_bin\msvcp140_1.dll,#11⤵PID:3016
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbcf5ac728,0x7ffbcf5ac734,0x7ffbcf5ac7402⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,1037293952453362425,15656230034113038589,262144 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1884 /prefetch:22⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,16390130697250122627,11114590718721490287,524288 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:32⤵
- System Time Discovery
PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,3870179604322037007,1793550743137013250,524288 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,6488695153799361220,12102846677906555775,2097152 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,12262761277529073567,2937435100870890631,2097152 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,9380579715290993051,18260881333762492583,2097152 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3952 /prefetch:22⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,13984114798389855681,2125580169028359889,2097152 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,15448674555473452968,1922534450457241093,524288 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:82⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5896,i,12905658953391672402,11437643148815547130,2097152 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5924 /prefetch:12⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,16242318032770399131,11053431941653705175,524288 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3516 /prefetch:82⤵PID:1760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,15230858922538325840,16152629667041868568,524288 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:82⤵PID:596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,14734279612909451154,14854812785144204167,524288 --field-trial-handle=1888,i,7139145231016128614,5034933280757791241,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3984 /prefetch:82⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 9ec7bdf8f33b42fd34063b76ea0c8cd5c8722a438d5e36fd08840f41a88430e4
- MD5 8378e6db5bd050d2ad23266031591ff9
- SHA1 352205d898dc36464698379ba4eb376e93536f37
- SHA512 17222acb25d3bb729af5a7a16ced51ab55c193d5eda5d1dc8d99e71efefe42f6c2b8d1d0a31d2eee1a3a0ab84c72ba21ee819c5f491ac5a804108dd46384f759
- TLSH T1EFF02DA6C835EC3718FD1B2D20A94B47EB6413672790885B3B3D830D8FB15774585D1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 408B
- SHA256 0f292a2b53edb0ac8973b87c563a33dcd323a10504951732ad6ac6fddc7b226f
- MD5 7b0a7d82a0b8be6853706c9ab4792dd3
- SHA1 50d7c0bd27dc097c75bf981962428a05e41b463e
- SHA512 97f18165a9679bf42959ca947bdb1df74790c9589f0a76aef37212616c232f19ef57ef8f598d6e4419b98d7d64021999c5b5f7a0bc7e53aaf357a0a2919a8633
- TLSH T1A5E0C25962F10BC7CF6053FE9B661991AF128C6A85C21D6D43DC8C0101AF9719D43945
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 1ad922b0b7deb9c5788da071c0d4baaa10bf328b8bad28022d6dffba9f3c398f
- MD5 8a111176d0cf53732c56783566495144
- SHA1 17a8bf99230d44da329bb9ceb8225a35694141f9
- SHA512 0aeb995556e48f17aa877d075ae348a89f4f3c3fb37078a2e19bfa5e78cfe83eb6b6c5b8e158c3b8ab59ad9d456aad2330b642c5910b90132a2f46fef3a85e12
- SSDEEP 48:YALlqIqyqthS0hxhS0dhih3sPWRsUWXLsHWfoKsxgmzsTVfs+osMKsWtsHJzsB/f:DVBIR7vdg1IvWWf8AUmQVBlCZ1R
- TLSH T146C17DB7C3D8866DC81156F4A7256F1FCE2E0A24532C3C66C8D8AF5B93E2872D21165E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 46dffe8468245f1fa04c0c8938adace85ce63aaef292c6fc06107c0b6e05cb15
- MD5 b9c370ca8d70f649c4512bdb449ef16a
- SHA1 9b64d61eac0d65e6b9208f80db90a2cb1a63410d
- SHA512 f8ea88a12f0f8a90850b1368ec6df3e7d24cea862c0bdffe409daab9cd2812a8384af7d102ed3490c846b8f2b5c672f019b246d311aa5b2aed00d2408637284d
- SSDEEP 192:VRNcBzby7Pa8AKPv7AIAPRp2G5n9qHsb+WNn5/44u2dhEkw9sVyIsnAUgraJ:VRNmzbyLZHkJXlkw9e2sie
- TLSH T1EE52C42EED14693BACDAD35AF9267B27EBF5103561D02E84EAFC8A2C14D75CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 ae2f9927961c6399977f5059e694656bb6b7594f9bc00a83cd207c1fd0d7c1f8
- MD5 9742e5f4e477b0a538ffd7bffb7cc1c7
- SHA1 47c8a6234b3bc93bc6b1ef048c77ad39c99213a6
- SHA512 eb59b718b9a78574c416611afda3dc7957ae586505eedf0358b26c0ea416915756bf5f08d099d2e739ccdbd21c457f327ed5e021ba02237f9dd2cef4ce331685
- SSDEEP 192:VRRby7Pa8Ayxv7AIAPRp2l9qHsb+WNn5/06hEkw9BVyIsnAUgtaJ:VRRbyL/hkJXmkw909R8
- TLSH T13442B52EED14693BACDAD32AFA167B63E7F5103521D42E84DAFC8A2C14D75CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9300a8e0d851f2d013a723e31b39ab5e1c3b24698b2b51fd9b06e4206a222eec
- MD5 a0d40b62849e0cb7a91df6e10fab0b3f
- SHA1 e9815501cc07e13458b85a5e17874454b4e34e35
- SHA512 bc1e89799d48fd5519a36284c66dbb892f29f1e8b931d209cf6c0aeb28660cd6a1b8333fcb51834a2dd1720916fdd7651a466116738e4f4f294bfd506484f2d2
- SSDEEP 192:VRNcBzby7Pa8AKxv7AIAPRp2G5n9qHsb+WNn5/44u2phEkw9BVyIsnAUgtaJ:VRNmzbyLZhkJXlkw9e2AR8
- TLSH T12242C42EED14693B9CDAD36AF9267B23EBF5103561D42E84EAFC8A2C14D75CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
- MD5 28aca1b912d001e337a9e715a111a353
- SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
- SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
- TLSH T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 6f524d5ea00acc6f77c04a8a72cff9f4a4fecfb2966786d979344c0115f327ff
- MD5 bc662dba3b5ddb3aa1bb28c976a4c1c2
- SHA1 2005c7597224ab34da8f33b062d41bba27f73431
- SHA512 c94849fdfaabb51913ea839e197dc61589783ce76ee3f98ff20bea6eb9fe08b7b9396270861e4024bbc42096f9dadbc489749176a40d5dc28b2122253fb7e860
- TLSH T1D1B0124080015102C80203F4114B248871989F20D70B174543E86A2288363918017054
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59aa9e.TMP
- Size 96B
- SHA256 70e37882b34d65f8da742063da2480aea0746a3223dbf35412de64e119aaba57
- MD5 f28a77b4f65074459405308ebeb56793
- SHA1 3d4ce83c02d29ae3bfc2cec83024b5d41ab9bfb3
- SHA512 8a26ec4b875679899d1e3e321693c671775549e8648d8877e54e4ea5201f517554c244c1302e3f3215367495b6b6d47e1c46c35d41f720140c3835f1042fcbb3
- TLSH T1AAB02200C0022202C08203F828C2BAC8B0A0CF20CA03020282FC0A22FC203202028820
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 369c1bf4dacdfdac346442146ddac0b231ecbdd34404869a176c19f606540949
- MD5 34c8c734d30961182a9e86ba0bee2bc6
- SHA1 482c1bd1fa9562b4b0d276640e6db79a670f9817
- SHA512 7d01ce1f43982b31e609a4140356e162bf13a3a3ed568dd7a548e60867b66330fa1afc77f68c83ec69a122b955ddd1c2bef6f4e70378b4774784fb0a78043a8d
- TLSH T11AA0021411D08C02DE004AF513C121C423195C650745C70365D40A5BBC6E183C907701
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 231KB
- SHA256 462d0cfc9bdad13f073b7ac95656d0056b0041479fae94821230ed7518357ce4
- MD5 8b84a2ea75ad84387be164b7317da26f
- SHA1 97d9dee1864dd7278d3550b590374ae9fb833eb4
- SHA512 251d15ff4e67ad96b0a938a0fff7548bc07e33aed47817c62e16e5aa3049c12e9e5228acf44c685570dba93cd126c674f9fdb4513474da0930feac149e464651
- SSDEEP 6144:t/m/kPmN86MiPEURFgI1PTDdm7Rkm1tYpBeh2BAoi:ccONRsiU9oBGcAoi
- TLSH T1C93422279D1FBD3A0938B356B14E632F1EB295BACD254EC685C84F805BBC9861B04D3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 232KB
- SHA256 4d9698e4e18102fe1daae4d01c68b09f5c76334f51960f8e3f231bb018af9485
- MD5 e65f5160acf2683754d8f458c29a0510
- SHA1 5e87174ac44e19acd91d05706749a0954339542f
- SHA512 dc804dd574735b7911987d0e51861a4650baa2c56d09527bf1492eccbca76f72e6f2a5ccee558d1c51551f380794b8f706014c98d4e3a13008f209d9c3a9908b
- SSDEEP 6144:kT/m/kPmN86MiPEURFgI1PTDdm7Rkm1tYpBeh2BAoi:JcONRsiU9oBGcAoi
- TLSH T1F23412379D1BBD3A0D79B75AA14D622F1EF1A67BCE254E89C4C80F409ABD8851F04D38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 231KB
- SHA256 116be76d941fe5d6bc3059f98e2114bc40965535df079df8dca5ec1771a9f6db
- MD5 bb55027a569a5e1a05818c18149e330b
- SHA1 b940a4a7dd1d7495b6a55b9be7d20da92050f7e9
- SHA512 2527f67fdedaae669113cab9710741e4718e0eef6d13b397698dd8adcfcc0b13d11f34849e0e47f6de82f55931fc9d08568e2a48e1f572f818c718d7eaeac69f
- SSDEEP 6144:C/m/kPmN86MiPEURFgI1PTDdm7Rkm1tYpBeh2BAoi:PcONRsiU9oBGcAoi
- TLSH T16D3422279D1FBD3A0938B356B14E632F1EB295BACD254ED685C84F405ABC9861B04D3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 92b7c2e563c997a5378339a970fb3f8af6713ba36835d58c997092cce0755941
- MD5 a31cef0bcca4b43f9a38a40c36365d6a
- SHA1 38b2fb1e5a0d8774837bae3d5564505c0c0aa413
- SHA512 916f6e86e2e558abd2e0bbd21278bc3bc5c9cb87f0943da41128ed90d645bea993462110653b0fcc38b7dcfcc6dab65a02afc864c2ed38efc5206936c2b21de2
- SSDEEP 3072:AlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:jm7Rkm1tYpBeh2BAog
- TLSH T152C3023B5E75E83B5CB5A74EB08E0F1E2EF149A6C920DE9288D85A0437F97CD0A44934
- MD5 SHA1 SHA512 SSDEEP TLSH