Overview
overview
8Static
static
5Start Windows.bat
windows10-2004-x64
8Tenacity.jar
windows10-2004-x64
1files/Upda...ty.ps1
windows10-2004-x64
3files/jre/...e.html
windows10-2004-x64
3files/jre/...64.dll
windows10-2004-x64
1files/jre/...64.dll
windows10-2004-x64
1files/jre/...64.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-1.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1files/jre/...-0.dll
windows10-2004-x64
1Analysis
- max time kernel
899s - max time network
889s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/07/2026, 14:30
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
Start Windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
Tenacity.jar
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
files/Update-Tenacity.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
files/jre/Welcome.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral5
Sample
files/jre/bin/JAWTAccessBridge-64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
files/jre/bin/JavaAccessBridge-64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
files/jre/bin/WindowsAccessBridge-64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
files/jre/bin/api-ms-win-core-console-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
files/jre/bin/api-ms-win-core-datetime-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
files/jre/bin/api-ms-win-core-debug-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
files/jre/bin/api-ms-win-core-errorhandling-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
files/jre/bin/api-ms-win-core-file-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
files/jre/bin/api-ms-win-core-file-l1-2-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
files/jre/bin/api-ms-win-core-file-l2-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
files/jre/bin/api-ms-win-core-handle-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
files/jre/bin/api-ms-win-core-heap-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
files/jre/bin/api-ms-win-core-interlocked-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
files/jre/bin/api-ms-win-core-libraryloader-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
files/jre/bin/api-ms-win-core-localization-l1-2-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
files/jre/bin/api-ms-win-core-memory-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
files/jre/bin/api-ms-win-core-namedpipe-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
files/jre/bin/api-ms-win-core-processenvironment-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
files/jre/bin/api-ms-win-core-processthreads-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
files/jre/bin/api-ms-win-core-processthreads-l1-1-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
files/jre/bin/api-ms-win-core-profile-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
files/jre/bin/api-ms-win-core-rtlsupport-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
files/jre/bin/api-ms-win-core-string-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
files/jre/bin/api-ms-win-core-synch-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral29
Sample
files/jre/bin/api-ms-win-core-synch-l1-2-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
files/jre/bin/api-ms-win-core-sysinfo-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral31
Sample
files/jre/bin/api-ms-win-core-timezone-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral32
Sample
files/jre/bin/api-ms-win-core-util-l1-1-0.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
General
- Target files/jre/Welcome.html
- Size 955B
- Sample260711-rt6k9set5t
- SHA256 db34008b34b4bc3177436e71bd01557d45d52e710699758ab227e5fec7ffadb8
- MD5 810ef9be9bdf09983d41e244a6179a20
- SHA1 d98ae54f03dac87419abc19b97e315830c2da55f
- SHA512 3da4de8d7a7d037aa64f9a771c9aeb743d43839294acb773cecb2ba9b0c869cf3d7f3e3bc41d803238f297647e85abd43f596f1c2df46579ec0a34263744e406
- TLSH T19711D0EFE9F49B12B76015D321E466E47BA941F55C63C85A3A1182029040E36930FBBD
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3320 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282548052923979" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 1260 chrome.exe 1260 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2740 wrote to memory of 1036 2740 chrome.exe 85 PID 2740 wrote to memory of 512 2740 chrome.exe 86 PID 2740 wrote to memory of 512 2740 chrome.exe 86 PID 2740 wrote to memory of 3320 2740 chrome.exe 87 PID 2740 wrote to memory of 1792 2740 chrome.exe 89 PID 2740 wrote to memory of 1792 2740 chrome.exe 89 PID 2740 wrote to memory of 1272 2740 chrome.exe 90 PID 2740 wrote to memory of 2284 2740 chrome.exe 91 PID 2740 wrote to memory of 1272 2740 chrome.exe 90 PID 2740 wrote to memory of 2284 2740 chrome.exe 91 PID 2740 wrote to memory of 2728 2740 chrome.exe 92 PID 2740 wrote to memory of 2728 2740 chrome.exe 92 PID 2740 wrote to memory of 4724 2740 chrome.exe 99 PID 2740 wrote to memory of 3668 2740 chrome.exe 110 PID 2740 wrote to memory of 3696 2740 chrome.exe 111 PID 2740 wrote to memory of 1524 2740 chrome.exe 112 PID 2740 wrote to memory of 1260 2740 chrome.exe 118 PID 2740 wrote to memory of 3384 2740 chrome.exe 119 PID 2740 wrote to memory of 3384 2740 chrome.exe 119
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\files\jre\Welcome.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffade21c728,0x7ffade21c734,0x7ffade21c7402⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,4646533310810359637,7396026368895553810,262144 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,4968816937605571173,2382681097414713642,524288 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:32⤵
- System Time Discovery
PID:3320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,1931290584479176913,14003747162595735815,524288 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:82⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,10477939007544947841,16592210791416331453,2097152 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,18055560130419000107,7164360418892750484,2097152 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4016,i,17324648490699625974,8034035499581052832,2097152 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4020 /prefetch:22⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,6558139646341644710,10537170275587868788,524288 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5308 /prefetch:82⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,9217570243137204013,2781715256290749147,524288 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:82⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,10808667032117952227,5765423011456235140,524288 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,4496393969847992951,9929752662940560855,524288 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5636,i,17951097002651906123,13650792149868618347,262144 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,15330197169746085415,8971199684043375629,524288 --field-trial-handle=2000,i,9937621703948309313,1302390786543814461,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e8a54051802278304f42097721742ed771f2d88e5bec8ff27b35813196282a85
- MD5 ace1aac3fb42833349508192190dd63b
- SHA1 d40f66c3c06b6fa581ca5cbae935b3ef93181386
- SHA512 78a5f44436a0fb4ed3aad4785abafb7b037ae64d004f6a06970bd9e1a1b85efc3e94a602c173e732a68cb1c85557efa4222745c2ddd22f7d7d8e47d6db5b4147
- TLSH T136E0ABB5C9229C3729FD1318B8654345EA5053172B80AC0F373C820C8FB477B42C282C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 8b0d3b170fdfc48854144e2b6a4414724e2e0a61618e39ac25d6fb1215fe272c
- MD5 ea9eed1decd9606dbd7c090961f61ea8
- SHA1 da5dde865f0fb7f405cdba87980e215fda3ab10c
- SHA512 d02e6a46aa870feb316f3e08be1b1d3fce3594ca7e817b58de9a32a45d79b9bb5bda4ba7e1a574f9307fe54450744d7ff6114e9d843df25fa488d8dce56daac7
- TLSH T136417BF793B4957E8A1196E4EA15AF1FCE6D0624031C3CB689D46E2B83F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 bed42b09aa8af3a8f5de6da8186558d21eb52cfc1878c954339b059a04a4ca61
- MD5 d017af0f7b868fa0916bde6d8ff4adbd
- SHA1 05c0f2743c69d6b5dbf31ebdfd04f5feacda0cd9
- SHA512 4f4eb6c1dd7e6f980c8f9dba59b6336df94e73aa8992108133f3710c5fc96256fdc85d512430bcf123c4a101508ced6d8c275bcc2f8fbe298e462e8c4b17808b
- TLSH T135419DF793B4857E8A1196F4EB156E1FCE6D0524032C3CA688D46E2B93F2972D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 cc2ae4fddef204e23dc7d9afdd0a6d8133deac6e68082ae1d2c34232e843943a
- MD5 0a7dd4b4bf10a21d0e6dbdaa413ef747
- SHA1 3936cb222da86510d1ebec6736901ac17f2acd9b
- SHA512 8d6cc75437fbb97834d88c96e66e086f5bec9fa42b6b856740ed5eb8325f519645aa1868eae4a811e6c60bb5dd56ff0e43ee578669e2bb2b4b0e3a919b6562ea
- TLSH T101417AF793E4857E8A1196F4EA156E1FDE6D0524032C78A688E46E2B93F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 5f67994ad94467b09ccc5aed41659ee72f38284eab33dbda399194e20dfd2ca7
- MD5 6ec62b2f85dff30de9d172ff8b813242
- SHA1 68ec72be738316ae3a1282e01e5f5e4975d105eb
- SHA512 59cc899068b255451a17d7cb352cc6f74b3dcb0252e430f52b9c4801d3b401a92caad6316d8be5aeb88ca3aca4c6a70bd201fcea75d7e4fbb934ebe62855bf78
- TLSH T191F09E77A76AB41750BD55FB1E80BC0A69BAB83001805CF4CF6AC27CE0545F70F2205B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 fbfd74970b9c2fe61321d66697770ce4356bc095fd42b5049e710a63bba350ec
- MD5 386aed2dc94406f1b23185c3cdae6452
- SHA1 21a5eb4377bfd3cf318f5cce3c6f63c47c9841ea
- SHA512 216a321d892b7687e32bc73af0522d4eda555d1a2567678989dbf58a01fe24198080e69a64b0892bf33863a045c69a92905325cfc21e0e008672cbcf5e07640f
- SSDEEP 192:FRUx+QWkqqhv7MF+pAPRp2oE9HHsb+WNn0iPiaGkwKU0VyIsnAUge:FRUxNNxgoUXi1wZPdGAe
- TLSH T10B42D66EEE1129BB6CCBC22AFD567B57D7F5102121C41E94EAFC8A1C04E76CD221301B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 d048873d8423b376a1d0d574d36fbbf3c68a8caf4b11a2cceeafd96f9b392331
- MD5 7f21149176c6bac01430de67205b4840
- SHA1 c2908bd6a64ba20ee90f779f56067916c55aa874
- SHA512 1bd78ca35c2cb116af6aee121ce55c01dfdc1430cb46d21d17a366fc28dafa49e48203602dcfaf70c26846c6bf87d10f0030cecf212135a424d8703fa8493b2a
- SSDEEP 192:FRUxzQWkqqhv7MF+p4XPRp1oE9HHsb+WNn0iPcaGkwKU3VyIsnAUgE:FRUxENxgoQXD1wZP/GBE
- TLSH T13852C56EAE1129BB6CCBD229FD567B57D7F4202121D01E94EBFC8A1C15E76CD221301B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
- MD5 73285efb9f7ee0bd384426865ccccf8e
- SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
- SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
- SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
- TLSH T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 5b52c2eb4a5b55e3d789e3bb411c8c62e479004cfccd482c270d492ea61acd3e
- MD5 f411bc68f217dd2cf6ac67d69ce85bec
- SHA1 33a03c409d866c4e117942575868b6aae110b8d6
- SHA512 0e10b6537107683087a8853778614131af60b2b11ba1f8383b91e00efa01f092c3f77ba20d030775a1cb64fec3af0253d7a686a12a16c610d7e24ac77d41a0fc
- TLSH T1F7B01241C0025501C05703B41D431C8871545F209B0A1B0283F07927CD691618519090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b83f.TMP
- Size 96B
- SHA256 622cefc0f21ead70132ad368ac7d7335b46c99cfaa329a1e6c5226cbdfa5da99
- MD5 02a6f9c58aa4d6f8c7ccad624463ef68
- SHA1 7cd799ed4f82f167257184fdba4d46b66ba824ff
- SHA512 a0d9c22735067f9e8ef6270b1067727357df2334f45dc51b7951806a805d3123cbf3042b327cae19ba8c65e01608b6ee6f8f794e3009e95a6316f166ae979af3
- TLSH T128B00256C2026612C04203B53FA5A5D8B2A0FF66CF53121396E41B66ED75F758569160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 80df79e22a2eb17cfec0e90a43c4b723c67a8feee2214c0cc7e15e5c06af121b
- MD5 87e3ac52a68272939a90f2978df38a91
- SHA1 4e5f5632fad4a6ede6bf342a77fa1fa0878f52d6
- SHA512 27783cbb9fdc48724dfbd9ccf3df72a1611bc97bcb9fc48f179360891d9f9eae0422bee09dff9c7aeadab6f2851c1f9ab92102853d8f9920f356bcee6a9ad478
- SSDEEP 3072:CNGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:CEm7Rkm1tYpBeh2BAoM
- TLSH T104C302375D75A83758B9BB1EB08E0B1F1EF14AA7D920DE92C8D85B0423F97CC1A49934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 9037f690259b26c3450826d4f837b6b6764dc8aee203d757e63f959f2eec035e
- MD5 96cd2dd59261a8bf4a821f31aee2b49a
- SHA1 e70202939a1c815355bd073ad80ceeb545ff2fe7
- SHA512 84b4e81951ece5a892c7f841f9c409c7c9bae089004b7e8ab8e62b06708c206751fa729bbd41f76559e43164991fadd3c2904640ade7bf5ae8722c23aea7b858
- SSDEEP 3072:CkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:CHm7Rkm1tYpBeh2BAoM
- TLSH T139C312275E75A93758A9B71EB08E0B1F1EF14966C820DE91C8D85B0427EA7CC1A49934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 1c7a3de1548b743d4bce7d4daffa121e25561c141e6185a5318519eea73d61a8
- MD5 853996836511b7ac63dfa2bff7832b65
- SHA1 85f3dfdb3fb7838e6d2bb608afb708530dde4673
- SHA512 2bea7689b5c46118298608ea577b6d831712179d4c8c71e24eca39365b24fe1086981a363e785389da657945f2301ac173312783e7311040a67ef610caff230d
- SSDEEP 3072:qNGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:qEm7Rkm1tYpBeh2BAoM
- TLSH T1BAC302375D75A83758B9BB1EB08E0B1F1EF14AA7D920DE92C8D85B0423F97CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 1a8e3e81b555dadd4d7e2bd3d376ce0695839059528c3eebf119da318c212604
- MD5 3581a432c0cd5da5f55d7afb5152cfef
- SHA1 e5ce91a0f2bf7c4fb9973db48c6c305349aac388
- SHA512 624d72c8ba4e82f7837da81e97ee95974ea2d59b851bcd580dd3aaac090aeeb5197b61ea2075ce81da96ef826192b1b734b5a69e8c72a4fbe11859b745d199ee
- SSDEEP 3072:/0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/3m7Rkm1tYpBeh2BAoM
- TLSH T14BC312275E75E9375878BB0EB08E0B1F1EF14AA6D930DE92C8D86B0467F97CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 2aced5745fe6a2fdf0885ed9085d6f7c74f4feea718003c34bd1141245abd9f2
- MD5 e02fc123c60c7e864193b3d15a3b2f5f
- SHA1 038391e010f7fdc2e56de7b94fb84541b53ec33b
- SHA512 7a5f7dd60106a76f5547fbc44d34373d560814340a250c4875a1ed23dbc3ca9079ecc95f95c34254857943781559ee58c5edcdbad245b0ec15882e46f803be4a
- SSDEEP 3072:nkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:nHm7Rkm1tYpBeh2BAoM
- TLSH T12EC312275E75E83758B9B71EB08E0B1F1EF14AA6C820DE91C8D85B0427EA7CC0A49934
- MD5 SHA1 SHA512 SSDEEP TLSH