Overview
overview
8Static
static
3Potassium.exe
windows11-21h2-x64
8WebView2Loader.dll
windows11-21h2-x64
1autoexec.lnk
windows11-21h2-x64
3bin/monaco/index.html
windows11-21h2-x64
4bin/monaco...ain.js
windows11-21h2-x64
3bin/monaco...tes.js
windows11-21h2-x64
3bin/monaco...ase.js
windows11-21h2-x64
3bin/monaco...ses.js
windows11-21h2-x64
3bin/monaco...del.js
windows11-21h2-x64
3bin/monaco...num.js
windows11-21h2-x64
3bin/monaco...tem.js
windows11-21h2-x64
3bin/monaco...ums.js
windows11-21h2-x64
3bin/monaco...nce.js
windows11-21h2-x64
3bin/monaco...del.js
windows11-21h2-x64
3bin/monaco...nal.js
windows11-21h2-x64
3bin/monaco...der.js
windows11-21h2-x64
3bin/monaco...ace.js
windows11-21h2-x64
3bin/monaco...-pd.js
windows11-21h2-x64
3bin/monaco...ons.js
windows11-21h2-x64
3bin/monaco...als.js
windows11-21h2-x64
3bin/monaco...rds.js
windows11-21h2-x64
3bin/monaco...ing.js
windows11-21h2-x64
3bin/monaco...ypt.js
windows11-21h2-x64
3bin/monaco...bug.js
windows11-21h2-x64
3bin/monaco...ath.js
windows11-21h2-x64
3bin/monaco.../os.js
windows11-21h2-x64
3bin/monaco...oth.js
windows11-21h2-x64
3bin/monaco...net.js
windows11-21h2-x64
3bin/monaco...gex.js
windows11-21h2-x64
3bin/monaco...ble.js
windows11-21h2-x64
3bin/monaco...ask.js
windows11-21h2-x64
3bin/monaco...ble.js
windows11-21h2-x64
3Analysis
- max time kernel
900s - max time network
882s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/07/2026, 18:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Potassium.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
900 seconds
Behavioral task
behavioral2
Sample
WebView2Loader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
autoexec.lnk
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
bin/monaco/index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral5
Sample
bin/monaco/vs/base/worker/workerMain.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral6
Sample
bin/monaco/vs/basic-languages/lua/autocompletes.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/base.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral8
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral9
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral10
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral11
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral12
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral13
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral14
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Model.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral15
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral16
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/ServiceProvider.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral17
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral18
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/functions-pd.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral19
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/functions.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral20
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/globals.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral21
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/keywords.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral22
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/Drawing.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral23
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/crypt.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral24
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/debug.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral25
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/math.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral26
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/os.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral27
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/oth.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral28
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/raknet.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral29
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/regex.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral30
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/table.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral31
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/task.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral32
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/modules-table.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
General
- Target bin/monaco/index.html
- Size 18KB
- Sample260705-wnxtdsav3l
- SHA256 589dfdfd1851ef4e64a6f346de8a25d125e9113957fde3c0f7e8ce330da9a63b
- MD5 8fd8d51f3c0c602ce8bb3ce24c759de0
- SHA1 a43d4d108728151cf5a4b4ad505de80c7f5c929c
- SHA512 a0054794d43959617923452d41bdce78caa541e8d2bf633db006a57779d75d80c3912b311521001e1fd05f8b60f589d6b52c776adc5309c7b7ed41b7e305a9c9
- SSDEEP 192:oIJbX0ggAbOmUSMKTnuMuTcJg5v2wzQW3V1VHDwFgBsK4u24FzZ+MHTq58BNLQPS:X0ggAbOmRJd/sV1VjwFgBs9SMwZ
- TLSH T19B8220DAB95F50CE7292326AE0FFF60AEC2DD17EA10506F6F69E6C708949106437342C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1236 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277483682808783" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 2412 chrome.exe 2412 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe Token: SeShutdownPrivilege 3392 chrome.exe Token: SeCreatePagefilePrivilege 3392 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe 3392 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3392 wrote to memory of 4560 3392 chrome.exe 81 PID 3392 wrote to memory of 4524 3392 chrome.exe 82 PID 3392 wrote to memory of 4524 3392 chrome.exe 82 PID 3392 wrote to memory of 1236 3392 chrome.exe 83 PID 3392 wrote to memory of 428 3392 chrome.exe 86 PID 3392 wrote to memory of 428 3392 chrome.exe 86 PID 3392 wrote to memory of 4540 3392 chrome.exe 87 PID 3392 wrote to memory of 4540 3392 chrome.exe 87 PID 3392 wrote to memory of 3724 3392 chrome.exe 88 PID 3392 wrote to memory of 3724 3392 chrome.exe 88 PID 3392 wrote to memory of 2496 3392 chrome.exe 89 PID 3392 wrote to memory of 2496 3392 chrome.exe 89 PID 3392 wrote to memory of 3240 3392 chrome.exe 90 PID 3392 wrote to memory of 5024 3392 chrome.exe 92 PID 3392 wrote to memory of 3836 3392 chrome.exe 93 PID 3392 wrote to memory of 1488 3392 chrome.exe 94 PID 3392 wrote to memory of 2412 3392 chrome.exe 95 PID 3392 wrote to memory of 4964 3392 chrome.exe 96 PID 3392 wrote to memory of 4964 3392 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\bin\monaco\index.html1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb650bc728,0x7ffb650bc734,0x7ffb650bc7402⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,3436741196967516273,1551909650246141259,262144 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:22⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,12729220707906116119,17582416647435948855,524288 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:112⤵
- System Time Discovery
PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,10414742207153371027,7572520166631409426,524288 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:132⤵PID:428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,14902865382024888942,15793183368512436118,2097152 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,14299296965212727954,6335551997258963621,2097152 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,2391122475430791574,6388387992870741618,2097152 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:92⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,12539197422077042407,271264727747262699,524288 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5352 /prefetch:142⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,15610751692570069173,12688241897444506930,524288 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5556 /prefetch:142⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,16257081532289554799,4847031022077677063,524288 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:142⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,6058689122060400433,3547647255478744454,524288 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:142⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3988,i,14374841293995789229,15202083174669922255,262144 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4456,i,2428150648006799776,18056180079706819770,524288 --field-trial-handle=1948,i,5441920170907593358,2907194611962472619,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:142⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 6f72e7efafc90df518ea47590c0760e1913bd06210a6fb5e2e6b6500a72907ee
- MD5 1d101502c84931c0c6c4f28cb4698d70
- SHA1 6a03ea12bcf3adc2de7cc11e9ad7f11fdc3dbe90
- SHA512 d60b62eec52618240779b85518867c2502929976699c3cdb453d2ae15160c20913578f78a29151115aefbac6b7091f370755d52ad21d1e593ed3167de695897e
- TLSH T156E0E5A6C821DC2708FA071C70944B8AE710039B2780C58E3A3C86088FB06760196D5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 131ec9d00f35bd59f39bbc40bbd074b64814dfc24f1517feace2160d78810279
- MD5 678edfe8cf520763ce5639c950a6ce54
- SHA1 bed16577c7e362464d85986c437f265ce5b2f4ee
- SHA512 e1a1a852961a484673273dfaaefc5da69728228bf690cbc7345ecd7185e781ae3fc0fc3a78566ab1ec3d0ec18a240d487912c3865eed429a2773b9defb761bab
- TLSH T172418BF793B4857D8A1196F4EB156E1FCE6D0924032C3CA689D46E2B93E2972D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 fa83d900749307b73986ec4246431fb6c03f5da1a80d81292e9b11d8159ebe7e
- MD5 c54896d91796244a7cb35410bb6a58db
- SHA1 5698e85a1ccb4abd2892b81ce6f713f7ab1fcb80
- SHA512 53e13618c96cf6c6f9e9f864effaf19cc6ecbfaaecbf80be59f09ce70b4bf815da8dc0d978a538c697166304fa4486c2ff62e2575fa56d7f8a464dbc0407a145
- TLSH T13741ADF793F4857E8A1196F4EB156E1FCE6E0924032D3CA688D46E1B93E2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d3de892dcc424dcc848fc8c477ea82b070904bb1011d01acb639b5a7eb6d4dea
- MD5 b13a484f88033b78728bbb201f4da10c
- SHA1 72180bcbe3e08d8035a7421e63168fd4bad4ad53
- SHA512 de8019f22d092240f37f63b98a443d77e211a32adaa4d2aa93ec3c535ffb03b06565375bdf2076f23278f8463694832f256356d9b3f0e0b4080ee734c10f7072
- TLSH T160419CF793E4857D8A1196E4EA156E1FCE6E0924032D3CA688D46E1B93E2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 c0f79b8dded992fd32202d9d4b0f5bdb742a9453859dd7d69ec9b0ccd4232f6a
- MD5 6a910ae00b8ab5366a2aeb4ec98e1600
- SHA1 3fa433838b2fbd9e9295bd42afc46bf4f0ae8361
- SHA512 d3b8a1fea5d17265bdc579c9b3f52aa97bec7738fda2c91045042147326e1f9a2c9aa8da9d22b8aec380988ba8e9d3525357813b8b8d18b1f7b6b7e9e7b36e26
- TLSH T15B418AF793F4857E8A1196E4EA156E1FCE6A0624031D3CA689D46E1B93F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 ae885dda4f5a00d433e7ba9b1bc2b28bb7c05ea917df0cde34e633ab14158320
- MD5 336edc0d56d148990f2c4619ec9ff246
- SHA1 60368ffa6a864f34b0992046e3bb5b62070d8d41
- SHA512 dc2617fafaaa726572c4f19b1eaf1ca3968fbfc8ec8aa3aa3fbb62cd86325ccb01c9acc0ec74db66c202c63014e5f98d3706e3cdfac5f48708722ba5920b5733
- TLSH T1D5F059ABE66EB417107989EB6D05780E5CB6B436038168E0CEAB816CD0D95B33B22087
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 85071319db8844726b7ac9d826980eb4c23ef15cadcbadc6a2e11e9fe9e5cce7
- MD5 95290576eb5cb870bc55589d0f566b28
- SHA1 3f674ff4ecaef5455fba8ce75c916bd404654fba
- SHA512 aba423238957d77faa5932403a486a4ed6a7c9d7da2e3d1daabbc6890161ca65f7a092d1559666706193105a46718c43ef413ccfce91f58ab0d7e193db0dbb47
- SSDEEP 192:RRZPvxfE4EEqRv7H+pXPRpzrw9WHsb+WNnY97PjJeRsauV+VyIsnAUgE:RRZXp2BihXAUwYlPPauV2E
- TLSH T14052D72BBD54687B9CDBD319FA663BA7E3F5102161D02E84E6FC8A2C11E75CD211702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 c0945f1439cb151092f72d0c6f7092490ea8da9c27e05a0ef38bb98632cb7bde
- MD5 f156dddcd1f60270ce527608026857ec
- SHA1 6790c4b66627106a423ccc3c3d7026385fd6094b
- SHA512 7e79489cb5aeaa3257c2bb73ee725f73e5c1e0d2f52aa4e4a1da024a46e55c70a165da801b5d4cef3c1dea67800aef3b51ac4bdc1c54f2fda84d86476174dba0
- SSDEEP 192:RRZPvOfE4EEqRv7H+pAPRp2rw9WHsb+WNnY97PYJeRsanV+VyIsnAUge:RRZXQ2BiUXHUwYlPEanV2e
- TLSH T16242C62EBD54687B9CDBD329FA663B93D7F5102161D02E80E6FC8A2C11E75CD212742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
- MD5 a6b03dd39d632b77a2b691136935ce1e
- SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
- SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
- SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
- TLSH T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 b9cf9ed6ba238e23663ed55f45639408065694f376a6daf6c87d74ba054d99d8
- MD5 f106e8ea0555adc897d69b9f4adf6fe4
- SHA1 700b5f67768387c133dff9ceefc01a7eda7a3325
- SHA512 e9c549023bde495dc010a664b3cbfd073f2b0a9f81e9bb2a34348725193972c2dff296783baf8f41b52f34a47ae27d03c52dcc989f3f25bcae4fd38763af0023
- TLSH T1FAB0128084415101C0060FF4114258C87228AF10DA0F1F0653E47D3388261558214450
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58490a.TMP
- Size 96B
- SHA256 240d52c9c90439eb142abca4491b8c9a1381d0f82dad917cc19c79e51038bfa4
- MD5 3f34c27c0ffaa9c3a7d2c72495c01e2c
- SHA1 6f0683558096f77ee1eec57e2f1821e97121fa77
- SHA512 a402f703bfc30e3a5e3efa35c5d77f5ad4c85e470b727683b3ef1a543ad33bf2f1cc556ec57d616c2c1b32b2c4d67f902524e437fe860aed1c6036ceced31780
- TLSH T17CB00256C18AF312C4D203B22ADAA5D8B660DF25C643222696F05A6BDC29B60552E6B2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 485d99b34ae0252ca7868d46c96c48e9f0fe9601102e6aee4bbdee91e942c1c8
- MD5 103d87e542c0a9c4f8222ffb72e853ec
- SHA1 c0e8a299df974964b57f478d2c905f4d5bcce371
- SHA512 73eab7663b22fb408a9e3c0096c56603afa6d7ebbdaa4ae66354f330150716c9feb9c3acf0b9205e1f283fb5a01aac90e2a04c1879192511835227986062371a
- SSDEEP 3072:jvyhzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:D4WDfxA3OnjrYQ9EU0/hEV
- TLSH T1EBC302A15C3ABD660DF8FE98640D3E60BFF46C9A91876DD2A2EC1F4C14FA5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 f1db2cb66b1a1c0ec9aedfd281adc5f9f9374b3d2e9b39c1c4f649f5dbd9a3e4
- MD5 0291890891f7c5a4ff49b9273aa60861
- SHA1 47d74672675db3434646c3eda932509b60b38255
- SHA512 9c57651a49b5f0d0bdd0d2d56450b20f2667183d7ed00d6ddd526f964fce08e61136d0f6d3477afff943f324142687cdead4ffd0ddd037d9bb75cd3f97a080ff
- SSDEEP 3072:jczzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:sWDfxA3OnjrYQ9EU0/hEV
- TLSH T1C2C302A11C39BD660DF9EE98640D3A60BFF4AC9A92875DD392ED1F4C14FB5C81139930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 23612eb150116684008d8bd5c691931193e8200cdcbdf53b40763b7e23143c1a
- MD5 00718c7d961aa738ae019bcac7ad76c3
- SHA1 1ff3bcc474699cccaf86b6bb06b69385353b08e7
- SHA512 268e598d6e7af43e2193fd27ef0345315a1bb7b3343685622db503ace0c13ad25e8e4c1651baf6fc0e9cf8068da1f101311667f53372651477f2589cae951928
- SSDEEP 3072:LvyhzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:L4WDfxA3OnjrYQ9EU0/hEV
- TLSH T194C302A15C3ABD660DF8EE98640D3E60BFF46C9A91476DD3A2EC2F4C14FA5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 ffbb2e032fd7b2febf13cdabeaea15a49eedf5d14274458571403226af43fa2e
- MD5 6115b69a68f7694ec599e3e8e7a71196
- SHA1 b9b23df53e8543796934d17a900f30510e671eaa
- SHA512 dcb7893fd18b53b6ca7d561c6b3d64aa2af9981a51f985cca56bbff3599b1c86d3f208d9bad7b688267fd74b6b5a8d449ab7e1f0e0e6aaa8276a79343194c6c5
- SSDEEP 3072:YczzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:tWDfxA3OnjrYQ9EU0/hEV
- TLSH T151C302A11C39BD660DF8EE98640D3A60BFF4AC9A92875DD392ED1F4C14FB5C8113A930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 ae1b46013677d84fd62c1e710ea5d1c3eea889b34ffc3a87c2477fcb55825846
- MD5 5b3d0f0d1b01c13f0947190ad3a866fe
- SHA1 cb54149f1cc5e0da91e0c9b9946c650645c053e9
- SHA512 ed5eadde226d307204917e140b0d4821d04e71e939032fb6a9bbb4db2a1cc9e4311d47c331758e11524629685485652f235eb8eaf476327562ce002a27db7286
- SSDEEP 3072:GzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:kWDfxA3OnjrYQ9EU0/hEV
- TLSH T1ACC302A15C3ABD660DF8EE98B40D3A60BFF4AC9A91835DC361ED2F0C14FA5C81139970
- MD5 SHA1 SHA512 SSDEEP TLSH