Overview
overview
4Static
static
3Bin/citize...ler.js
windows10-2004-x64
Bin/citize...ler.js
windows11-ltsc_2024-x64
3Bin/citize...nit.js
windows10-2004-x64
3Bin/citize...nit.js
windows11-ltsc_2024-x64
3Bin/citize...ole.js
windows10-2004-x64
3Bin/citize...ole.js
windows11-ltsc_2024-x64
3Bin/citize...er2.js
windows10-2004-x64
3Bin/citize...er2.js
windows11-ltsc_2024-x64
3Bin/citize...x.d.js
windows10-2004-x64
3Bin/citize...x.d.js
windows11-ltsc_2024-x64
3Bin/citize...ain.js
windows10-2004-x64
3Bin/citize...ain.js
windows11-ltsc_2024-x64
3Bin/citize...ack.js
windows10-2004-x64
3Bin/citize...ack.js
windows11-ltsc_2024-x64
3Bin/citize...lob.js
windows10-2004-x64
3Bin/citize...lob.js
windows11-ltsc_2024-x64
3Bin/citize....d.vbs
windows10-2004-x64
1Bin/citize....d.vbs
windows11-ltsc_2024-x64
1Bin/citize...ver.js
windows10-2004-x64
3Bin/citize...ver.js
windows11-ltsc_2024-x64
3Bin/citize...mer.js
windows10-2004-x64
3Bin/citize...mer.js
windows11-ltsc_2024-x64
3Bin/citize...hat.js
windows10-2004-x64
3Bin/citize...hat.js
windows11-ltsc_2024-x64
3Bin/citize...800.js
windows10-2004-x64
3Bin/citize...800.js
windows11-ltsc_2024-x64
3Bin/citize...800.js
windows10-2004-x64
3Bin/citize...800.js
windows11-ltsc_2024-x64
3Bin/citize...x.html
windows10-2004-x64
3Bin/citize...x.html
windows11-ltsc_2024-x64
4Bin/citize...ils.js
windows10-2004-x64
3Bin/citize...ils.js
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
740s - max time network
748s - platform
windows10-2004_x64 - resource
win10v2004-20260513-es - resource tags
arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows - submitted
03/07/2026, 22:28
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Bin/citizen/scripting/lua/scheduler.js
Resource
win10v2004-20260513-es
windows10-2004-x64
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
Bin/citizen/scripting/lua/scheduler.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral3
Sample
Bin/citizen/scripting/resource_init.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
Bin/citizen/scripting/resource_init.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
Bin/citizen/scripting/v8/console.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral6
Sample
Bin/citizen/scripting/v8/console.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
Bin/citizen/scripting/v8/eventemitter2.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral8
Sample
Bin/citizen/scripting/v8/eventemitter2.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral9
Sample
Bin/citizen/scripting/v8/index.d.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral10
Sample
Bin/citizen/scripting/v8/index.d.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral11
Sample
Bin/citizen/scripting/v8/main.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral12
Sample
Bin/citizen/scripting/v8/main.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral13
Sample
Bin/citizen/scripting/v8/msgpack.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral14
Sample
Bin/citizen/scripting/v8/msgpack.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral15
Sample
Bin/citizen/scripting/v8/natives_blob.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral16
Sample
Bin/citizen/scripting/v8/natives_blob.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral17
Sample
Bin/citizen/scripting/v8/natives_server.d.vbs
Resource
win10v2004-20260513-es
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
Bin/citizen/scripting/v8/natives_server.d.vbs
Resource
win11ltsc2024-20260630-es
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
Bin/citizen/scripting/v8/natives_server.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral20
Sample
Bin/citizen/scripting/v8/natives_server.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral21
Sample
Bin/citizen/scripting/v8/timer.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral22
Sample
Bin/citizen/scripting/v8/timer.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral23
Sample
Bin/citizen/system_resources/chat/cl_chat.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral24
Sample
Bin/citizen/system_resources/chat/cl_chat.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral25
Sample
Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral26
Sample
Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral27
Sample
Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral28
Sample
Bin/citizen/system_resources/monitor/panel/index-f9doidst.v800.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral29
Sample
Bin/citizen/system_resources/monitor/panel/index.html
Resource
win10v2004-20260513-es
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral30
Sample
Bin/citizen/system_resources/monitor/panel/index.html
Resource
win11ltsc2024-20260630-es
windows11-ltsc_2024-x64
11 signatures
900 seconds
Behavioral task
behavioral31
Sample
Bin/citizen/system_resources/monitor/resource/menu/vendor/freecam/utils.js
Resource
win10v2004-20260513-es
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral32
Sample
Bin/citizen/system_resources/monitor/resource/menu/vendor/freecam/utils.js
Resource
win11ltsc2024-20260629-es
windows11-ltsc_2024-x64
1 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target Bin/citizen/scripting/lua/scheduler.js
- Size 22KB
- Sample260703-2d2x9agy91
- SHA256 9b4043c0bbe0fbade2a79a65e9f5739b0d55245ab1defaf05ce507b63b354def
- MD5 3e8de11518c3d0c535eb5a70756f8451
- SHA1 68f906898a68bcbc9b85fded76620c5f6e230ad9
- SHA512 b4c6032925dfb3058134a6cc659342d8b1892e11b7d6e5ad163446ed4e364d6192e592df2946c4c85168f107f570ca17fa4521600923dae81499714e5c3b8e7a
- SSDEEP 384:eVJqoFnzU0QEwSlhDOVBl3VJoPTwZCdJyzJduHkTVzyAuAaoSr/z6eN3rVM5iGL8:IJqoFnzU0QEdha7l3VJoPFJyzbacV+AI
- TLSH T199A2A85FF24F51528EA171A6C73F9681A83EE677143D1295F4C04FA524106ACC2EBEEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2488 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275923138454102" chrome.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "72" LogonUI.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 824 chrome.exe 824 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe Token: SeShutdownPrivilege 3872 chrome.exe Token: SeCreatePagefilePrivilege 3872 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe 3872 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2388 LogonUI.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3872 wrote to memory of 2108 3872 chrome.exe 98 PID 3872 wrote to memory of 4416 3872 chrome.exe 99 PID 3872 wrote to memory of 4416 3872 chrome.exe 99 PID 3872 wrote to memory of 2488 3872 chrome.exe 100 PID 3872 wrote to memory of 4140 3872 chrome.exe 101 PID 3872 wrote to memory of 4140 3872 chrome.exe 101 PID 3872 wrote to memory of 604 3872 chrome.exe 103 PID 3872 wrote to memory of 4948 3872 chrome.exe 104 PID 3872 wrote to memory of 604 3872 chrome.exe 103 PID 3872 wrote to memory of 4948 3872 chrome.exe 104 PID 3872 wrote to memory of 4708 3872 chrome.exe 105 PID 3872 wrote to memory of 4708 3872 chrome.exe 105 PID 3872 wrote to memory of 4124 3872 chrome.exe 106 PID 3872 wrote to memory of 4124 3872 chrome.exe 106 PID 3872 wrote to memory of 2296 3872 chrome.exe 107 PID 3872 wrote to memory of 2296 3872 chrome.exe 107 PID 3872 wrote to memory of 2120 3872 chrome.exe 108 PID 3872 wrote to memory of 2576 3872 chrome.exe 112 PID 3872 wrote to memory of 2336 3872 chrome.exe 113 PID 3872 wrote to memory of 3388 3872 chrome.exe 114 PID 3872 wrote to memory of 4564 3872 chrome.exe 115 PID 3872 wrote to memory of 4564 3872 chrome.exe 115 PID 3872 wrote to memory of 824 3872 chrome.exe 116
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Bin\citizen\scripting\lua\scheduler.js1⤵PID:3248
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff80ebec728,0x7ff80ebec734,0x7ff80ebec7402⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,2298929722771715381,9891427461356740453,262144 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1896 /prefetch:22⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,2737581905427650280,15995605131898854692,524288 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:32⤵
- System Time Discovery
PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,6999430846105613527,3844378122614164445,524288 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:82⤵PID:4140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,11163357470649204654,9931709765221205402,2097152 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3476,i,2867207427942772067,4263490382296433078,2097152 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,3196418465887781692,17967117822090708892,2097152 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4764,i,16484887718010980407,11770489068951924687,524288 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,3896248493664358143,4794948630365220736,524288 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4892 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,2845300437806620208,13387168542358683541,524288 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,3972866158190147426,13880331050935173316,524288 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:82⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,15081903648469427451,5259220430130650420,524288 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,7879381067164460704,16717076401461220678,524288 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:82⤵PID:3388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5564,i,15584144622327536450,1846089477082242964,2097152 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:12⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5828,i,10889634348137623710,3695162257828508037,262144 --field-trial-handle=1904,i,5432037196344370661,1475218725006233706,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:824
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:4524
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa395a055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2388
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 ead862f63411bbb83e88f8930370cdf0ef0f67d28691f158b7b28d4bcbf29519
- MD5 919c9df9d0a081656b1e251bedb7b3a2
- SHA1 2091454d63389f9473812bd9d6e5e5a572c959a6
- SHA512 cd43b95862e681f3e033d0c43f93e91e2f2cfc21a6d3b5152fd1fac5864bce84e92d688a4cf34ba754f74308291c25ec7f60ccef72045c20d767ea53f06cc5ad
- TLSH T114E02BAAD9319C6B1AF9472C60940B46E64013573B40898F3A3C810ECFB5B37064581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 f1dc1701790f4f07fd5cae1592301bb80733a4c3e54e69e57d184a3999ee3bdb
- MD5 ece1d63b8f9d2818cf6ee86c745bcbf9
- SHA1 d42f9df1483857e46c0a601f2c9a90943f183e52
- SHA512 90aa6aa112e7e177a5d23f683e85719dcfe09e03947b1224bf84dbdeda3e344dccdd0ccc66f26f004c5fc9a6ce1fd3ea61295f1263e3295baf212e6a8936c9a4
- TLSH T110D0123AA778468FF7A50E71D04026D1622E141A43526E5FA7F4F00159C9645E53B192
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 7e160d310a90e6acdbeaa43eee8ffe4006074c1d7d412fe3c5dd763e56ab5434
- MD5 e10c809d8f25525cc075967080cb8239
- SHA1 b09aab3b966a550c48f52515e472e29bea7ea9d5
- SHA512 a716a2771e3828659b6e985ff8bde7237d9df133dc4f94bb65b30bf8296c484e6548d46a0966fc8a72d1385455bf4acd13f590b7105808cd82d68edf08d214bf
- TLSH T160719EF7D3D4DA7DC91156F49A216E1FDD6D0A24122C3C6288D4AE5F53F6872E20138E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d639ac3076380a7016ff3bfe305a3f6f95d0efc5cb01d2642891f18a3c81499b
- MD5 d3cf0257ec2b0712db70637b67387d97
- SHA1 c7e6825240db4775fa44a4be5ab0e3604be4c804
- SHA512 438cc773b5a6017e6f06f7979badc970fa49667d0d1b8309757f84ad68f0da4836665ddcf45e903fce72863dd65b34f3cc81376db56b28dd62ee17e3611317c4
- TLSH T1AD41ADF3D3E8957EC92152F49B116E1FCE7E0A24121C3C6289D4AF1B53E2872D21138E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 771ed8182146ff1c79e8ed2d6c7f959094b77721d07d225f8631a65c71688bbc
- MD5 57b847a0ff55ec008475340c5df972f1
- SHA1 3f9173ca732fc09faa1785e99cbdc912a211654d
- SHA512 8f7c88d75a48926878657c0b44a9ed65c67e34c6a89933672e203f250edd5aad6f89aea2862befa70e9cd6544fbbc7d9bba7c7e150d42cc7255d1186705f2151
- SSDEEP 192:xRbcx1bv78hAPRp209DHsb+WNnyn0r82q+uLKVyIsnAUgraJ:xRbczj48XD5w80w2qWe
- TLSH T1C442FA2EB9106D7B6DDBD22AFD667B17D3F2102161912E84E6FC8A1C16E75CC322701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 a58ba39482a616e15fcd8b5fc8b6d77966271ea6a55fa96c8b7402a678b9fd26
- MD5 cb64d6e613188915237d581db5a092ce
- SHA1 c869dc243901890bf05145038f34d65b655a8418
- SHA512 20bbe794452b16dc1c57d37e50fc6d5f57bf1580e314baf9191d2d48ebf706bffdefb711c788b999120cc86c8ac8885284b01b3046b6f8fc5c3e922f7228a83d
- SSDEEP 192:xRbcxYlv78hAPRp209DHsb+WNnyn0F82q+uLYVyIsnAUgtaJ:xRbcuV48XD5w80W2qI8
- TLSH T11942F92EBA106D3B5DEBC22AFD657B13D3F2102161912E84EAFC8A1C16E75CC312701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 694de0ef262c605202c7aa7537624d6f53e42b57ffb4888850d65f1a63273e8b
- MD5 be2124b9123c9c7997d1cc2f36bbf8ed
- SHA1 353b5a3863bfe33eeaf3f0f78c64ff8ca5e486f8
- SHA512 48a1e0d1e44aa73b5eed563855cb4860c010e8f27f59478bd40ce8dadb5e370f7cfc16a75b12333201ebc0e01fb4645027df8c4ce732ae2c2263762125ba6926
- SSDEEP 192:xRGcx1Yv78hUPRpS09DHsb+WNnyn0d82q+uL4VyIsnAUgraJ:xRGczE4gXH5w80O2q4e
- TLSH T1CB42E92EB9102D7B6DDBD229FD657B57D3F2202121902E84E6FC8A1C16E75CC322711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 c7dc4bd8eb380624a44d602920a9ed68f43426fe78b705ec65c9ba103a1e03ec
- MD5 67609db78772d10920be18c45a1e7702
- SHA1 6bf7ff38d84acd5e58dc30d75eb2b007e4557448
- SHA512 1cf24c8acbbc08dd446b3709982651459298008e10f8aedae1437c75c26a0abd2660b9cdfca4c01d41c1a80d3a19ed56420dee7945a3d8f7197ec2798d8474fd
- SSDEEP 192:xRbcx1Av78hUPRpS09DHsb+WNnyn0d82q+uL4VyIsnAUgraJ:xRbczc4gXH5w80O2q4e
- TLSH T1DB42E92EB9102D7B6DEBD229FD657B57D3F6202121912E84E6FC8A1C16E75CC322701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 321e4f02fb7919d4369f636d6e5b241395036acc40295995f42e4fc78b294cbb
- MD5 c0fec241e3390413ddbeda32781b0c77
- SHA1 230f9cf01114eb970a57f57c7e5b97619f87b0eb
- SHA512 b7635f7afb9becee6e834ed417b4c221c7ee9dca0cc37a6091e55630a09db38532a249d7628661fe123f76f8d5841fe57a94100c75f2466b8612c937f009536c
- SSDEEP 192:xRGc/1Yv78hUPRpS09DHsb+WNnyn0d82q+uL4VyIsnAUgraJ:xRGctE4gXH5w80O2q4e
- TLSH T12D42E92EB9106D7B6DDBD22AFD657B57D3F2202121902E84E6FC8A1C16E75CC322711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 aa5246622c13df686f63e63f12c67cf98961f7ea547b81f0b33a9fe7cd09ed2a
- MD5 f6b758faf75d50317268b7981352df3c
- SHA1 67bc3402483c05b18262f1b77e9de9bf99e03524
- SHA512 93b34b595adee49d7d4d6f06465894bda82be26ae85fa45c1c16d7c451f9afdd386b5334edc14ed9cba0cdcb29f91932a1f66ce6d42341bfdc3dbd9b9113539f
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3y1H1/5UtGvtEe:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSF
- TLSH T1B652E927688D9A3B0FD8D54DDC16BF4F6DB601576278486853FA5C0803A97CB124B2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 6a3820e44f5e00dead346524f5e9990869b66a57f840d776c8415062bf26bdca
- MD5 f0cd468f25bcfb59b9e1e819a17c8db4
- SHA1 e95b97df53afd3a2cd56b649a06cfe2f035c9edf
- SHA512 0b6342ca21ae5b6b5921d54d9257fb3c8225c8f35995ad2a9d2ea46007e9b7afafc784e22e33d4e746f241baa7919da35ab080dc328a3dae66ad6df7de9be72c
- SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:qm7Rkm1tYpBeh2BAoO
- TLSH T175C3123B5D75E9775D79AB0EB48E0B1E1EF249A6C930DE4288D46B0433FA7CC1A04A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 234KB
- SHA256 46bac9da61d172a99e8001db538e90bd5fcf4132c9c1ff07eff0e872821b11c8
- MD5 d8e2b928ce7dcc3b170e15a0d826ac6a
- SHA1 5e5b01e78269aafd57b4601d04ae3633c9a1890b
- SHA512 f8698061f905c9c28db218bfa7ea9800097a1b1264b8d14d6ab2886a1d794d9ab144c5fbf61104a8313a1dea5f522dc91f090c4b4469c9ad1c902276d5384660
- SSDEEP 6144:w16mg1kQfATCFbzQACjJm7Rkm1tYpBeh2BAoR:YKneA59oBGcAoR
- TLSH T15734233F4DB04D7A1B651B6A608A1E3D2EF29F7BCE215E88C1D91B4437DED891B46830
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 233KB
- SHA256 3f1b5e98262d0453f6cf2faa3ea2308f6021b228891642671a6630b48920b3ad
- MD5 598f51e0f374f653adc1af387c17b2d5
- SHA1 1fe9f99ced6bcb2976f03fa0e1a8421b491770d2
- SHA512 203e47faadb824a5ceb1227e1f23bb1c08a50ca26f80e37c4979a26001b9e415e1905e880a48d4c560e53d9cf443e18d5d1ea0db81f58ca38c221982869814a0
- SSDEEP 6144:Aymg1kQfATCFbzQACjJm7Rkm1tYpBeh2BAoR:AineA59oBGcAoR
- TLSH T1FA34231F8EB05D7E1B251A66708A0F2E26F29F7BCE215E98C1D91B4437DAECD1745830
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 233KB
- SHA256 a21420cdc9c3976c3bab1ed1adad4860694a31e45ce84213b23deab55cc6ff39
- MD5 a7d8214a1b2e81e9d4da14c7bfaac97e
- SHA1 aff32fb412e50d453f2c35ae05e5a4e0f3f53ec7
- SHA512 a4d7a194eab08e37859367315b91e6e8912716db89ce27588513b0bfe18f5295dc978d7fb32f22b5f05065c75e3e4f465d9ae5c0e90041f5ae75bceeca10d472
- SSDEEP 6144:Nymg1kQfATCFbzQACjJm7Rkm1tYpBeh2BAoR:NineA59oBGcAoR
- TLSH T10834231F8EB05D7E1B291A66708A0E2E26F29F7BCE215E9881D91B4437DAECD1745830
- MD5 SHA1 SHA512 SSDEEP TLSH