Analysis
- user interaction
yes - max time kernel
576s - max time network
577s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/07/2026, 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
smartscreen.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
900 seconds
Behavioral task
behavioral2
Sample
smartscreen.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
900 seconds
Behavioral task
behavioral3
Sample
smartscreen.exe
Resource
win11-20260513-en
windows11-21h2-x64
16 signatures
900 seconds
Behavioral task
behavioral4
Sample
smartscreen.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
900 seconds
Errors
Reason
Machine shutdown
General
- Target smartscreen.exe
- Size 596KB
- Sample260712-2j89hsbw21
- SHA256 5eba5b6b1dbedcd7db79a7bcbb4a0abd58cb14c0538f12d7fd7b3722beed3d06
- MD5 840d5571de5fa889dbd28fcc41e8fffc
- SHA1 98266ab0ef2146eb396f087d9b5a2f5a25bb3727
- SHA512 7d27ca9a388caf81b64ba097061f9dc78485fe17277f91cb31085a92d0a463ae8aa617cc0ce355b352e48dea5118a12e66cc45f5120a495794580ecb294ceb9b
- SSDEEP 12288:Ht9OevGd37vbbpm4cJcuKoEKf08tsh4Nnv:N9XGh7vUVubh4Nnv
- TLSH T1D2D42C5E66AC07E1E17AD07DC983460EE6B178355332D7CF036142AA4F27AE85F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5916 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "7" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283695035999461" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5476 chrome.exe 5476 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe Token: SeShutdownPrivilege 5640 chrome.exe Token: SeCreatePagefilePrivilege 5640 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe 5640 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5448 LogonUI.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 5640 wrote to memory of 5672 5640 chrome.exe 90 PID 5640 wrote to memory of 5916 5640 chrome.exe 91 PID 5640 wrote to memory of 5900 5640 chrome.exe 92 PID 5640 wrote to memory of 5900 5640 chrome.exe 92 PID 5640 wrote to memory of 5872 5640 chrome.exe 93 PID 5640 wrote to memory of 5872 5640 chrome.exe 93 PID 5640 wrote to memory of 5968 5640 chrome.exe 95 PID 5640 wrote to memory of 6068 5640 chrome.exe 96 PID 5640 wrote to memory of 5968 5640 chrome.exe 95 PID 5640 wrote to memory of 6068 5640 chrome.exe 96 PID 5640 wrote to memory of 5784 5640 chrome.exe 97 PID 5640 wrote to memory of 5784 5640 chrome.exe 97 PID 5640 wrote to memory of 4144 5640 chrome.exe 99 PID 5640 wrote to memory of 4144 5640 chrome.exe 99 PID 5640 wrote to memory of 3064 5640 chrome.exe 100 PID 5640 wrote to memory of 3096 5640 chrome.exe 113 PID 5640 wrote to memory of 3804 5640 chrome.exe 114 PID 5640 wrote to memory of 5232 5640 chrome.exe 115 PID 5640 wrote to memory of 5476 5640 chrome.exe 116 PID 5640 wrote to memory of 5176 5640 chrome.exe 117 PID 5640 wrote to memory of 5176 5640 chrome.exe 117 PID 5640 wrote to memory of 3324 5640 chrome.exe 118 PID 5640 wrote to memory of 3324 5640 chrome.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"1⤵PID:4808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcff27c728,0x7ffcff27c734,0x7ffcff27c7402⤵PID:5672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,11382328577733554188,8271730439056819840,524288 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:32⤵
- System Time Discovery
PID:5916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,15225052576336546584,13253608222900238632,262144 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:22⤵PID:5900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,15341937523516237396,4729098197737155146,524288 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:82⤵PID:5872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,14372561282002100121,15248190887572422593,2097152 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:5968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,6328069338643531351,11140989673709459607,2097152 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:6068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,8098963240098323745,17121472208390674743,2097152 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:22⤵PID:5784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,16171059933838854278,4492424586233117995,2097152 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,4826928224951442218,3772769803961019483,524288 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:82⤵PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,2751413408924861233,13740724376168014069,524288 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:82⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,8230955176584441090,12629071284817026532,524288 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:82⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,7716802083605159939,17666398614745889452,524288 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:5232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4568,i,5921352829322203738,10102410244325672584,262144 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,8825512512988459978,9891742979762609665,524288 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4584 /prefetch:82⤵PID:5176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,3926001320372564372,15342479642455721119,524288 --field-trial-handle=1996,i,108907208931620622,6656936070684071304,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:82⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4892
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x500 0x4ec1⤵PID:3684
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38da055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 33bc3354459ba4094583b586c20d49ca500eb184d460622e3904b9ef5605b522
- MD5 033b085d7954c28589fea8ab8000eb71
- SHA1 bf139d2d212a033edb3a1ad2bcbb9ed66d4c8646
- SHA512 e1a5bf7dc56c3b59d1c24b8a62c862dad66357440818b48435b1a1fe568a5a9111af7129461efe556566a97bd3d4c057372630e20d58fbd3364d216404f97db4
- TLSH T11EE02BAAC961DC3728FD0B1DA1505785E65413573780458F3F3C95084F7423B4646C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 7dbf96ab215d0ac1e44f4c01d15dec932f9d2c39ae487bdc0877d9cdd48f0650
- MD5 3727d1853e2dd846363eaadd851dcc9b
- SHA1 a4061f8e5b93c3a2c868f50319958ee18fab0017
- SHA512 f7bc8d2e36f3e091a6f05c847ba999d5877f8903a65028e8a27bca4f207135347f64a2a8faeba1d215da0a8e398fd381d8a1108d2287f410ad4143eaa858ea68
- TLSH T1C241ACF793E4CA6D851092F4DB11AE1FCE390A24131C3C7289D8AE1B43E2873D21179E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 115adae9e819deecaa56dfc36bce472d0c4ea1c1aaa25a27c5c0389f3d157e3b
- MD5 5a3a7b312a9ed7f5a2e2dcf11c629d50
- SHA1 769b7f8ab378adfe2abf4c6a677f51843ecdb457
- SHA512 1aaa2e603d1bdb12f2b0094af9883ae413604989f7fa5c3d7c3d50991147ed30ac14f4dfb075c5345e68bc10aaab51c8560f86c529b2e18c39e141eac72e48c9
- TLSH T17251ACF3D3E48A6DC51192F89B216E1FCE290A24131D3C6689D8BE5B53E28B2D20174E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 23d4236b18afe13590bb26bd9a0f145de2667637a91de905869cb789daca3816
- MD5 0fd252b9eddb55361ec67d22eb759726
- SHA1 1efd06e27c0685b3ce2a1ebd90a46d26beb2fa3d
- SHA512 0866c3985df262d8ea54ae645466d3a47fb847721ccac28a229322e3020f65eb68292199e810b808b84bf12835f6d7850e69510fafb5f9b23eb0218dcfc0aeb6
- TLSH T16151ADF793E4CA7D851096F4EB11AE1FDE390924132C7C7289D8AE1B43E2972D24178E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6ddff57af83898934a01bda09f490424f0b56edbed52f6d2ff7918935e4f78b4
- MD5 aabd9c7030b83a6e056ca4bbbf453ef6
- SHA1 afe4bacff60ef0354623791590788ac584a06f4f
- SHA512 ea7049ce3afd4a7a29d7189b19c9c0676a1845866f2016292a02df51b7671022223b67320c22a5cc16d2f34a59f8d0478c2e3891f56b296957e7130bc3adf0b4
- SSDEEP 192:izRQlU1A9Wn3AJ/GKRRtvv71hpAPRp2g92Hsb+WNnQLML40aXsOeBL0VyIsnAUge:6R7/qRLBhUXDQw/40Zce
- TLSH T15742C82EA91069776CDBD22AF9227B53D7F5102622E52E80E7FCCA1C15E75CC222741F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 6baa1394ab6762a34c82c502eba45ee57ab3110a9b4653e1b931f53fdf746001
- MD5 f601cff1da79b0ec850ac881fac26153
- SHA1 414e91bf4441b281e7cc75e85a49b8887299bb70
- SHA512 bad867d200dbf4aa619e52d341afa50045f9f2ae61ec382c5725ec676490b8fd1d32a011baca85777af538433bfe189ceba9f101bea5ea9207cc6b64f112fc0d
- SSDEEP 192:izRQlU1A9Wn3AJ/GKRRNxvv71hpOPRpog92Hsb+WNPiNiXWztNAq6WsOeBF0VyI6:6R7/qRDhBhqXFQwqomztqTVWe
- TLSH T1C052D76FA910697B6CDBD22AF9227B53D7F5102222E51E80E7FCCA1C15E75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 18fc023f13dfea8e31771a923a74bdf844e9fb7fcc1b0fd4efc4f8a9a8feed6a
- MD5 c84d4d3693943a2acf23584e6015d807
- SHA1 e90085696bae4a9194a21a96b851459a15ed545a
- SHA512 810b2e84581e3b99fe6b3a85b72ca135d10a99343c71fd110d45d52e81d266493319fabff8ac86d1738800146ed8b73719b3b71fed46da03931b901ec4cef22c
- SSDEEP 192:izRQlU1A9W/RQT/GKRRtkvv71hpAPRp2g92Hsb+WNnQLML40a1sOeBe0VyIsnAU/:6R7/5Q7RaBhUXDQw/40Vx8
- TLSH T15042B62AA920657B6CDBD22AFD227B53D7F5102522E52E80E7FCCA1C15DB5CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 6fb106d85fa7d3a5f9b768dbca3e140cd9dd612a88c84d6b578684f147868b30
- MD5 8c2e7f5e1abb25d68507ca1220135421
- SHA1 614445569553340b4941c68bfe2fcbc5c1d6f94e
- SHA512 8454392156fefe9a10800ded952e29ac2df268782ac3e6b4e0998d3d65085139f6e5b3befb127c4dd6fd1fbfd80e51bc49cb226ea2e39b821d1b87dcc29fea1a
- SSDEEP 192:kARQlU1A9Wn3AJ/GKRRNxvv71hpOPRpog92Hsb+WNPiNitWleNAq64sOeBF0VyI6:kAR7/qRDhBhqXFQwqosleqTPWe
- TLSH T14352C72FA91069776CDBD22AF9227B53D7F5102222E51E80E7FCCA1C15E75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 939523d89f1d2c14ac7deeddfcb7bda3aca1b2ffde4e8177d8c32521919cf123
- MD5 a9703fc6213ffec173aba8c4723c669d
- SHA1 11444afacf28f375ba9a0b0d5ed2662b2d5f46fd
- SHA512 b7c3b478228a41be2bc6e8982b81b0e4fed44d439a3af4fe58a569ad909813d9b5ff82c8626ebbdceef2dd9e02e74d9ff393db560ad0e569eeab3c2b91497900
- SSDEEP 192:kARQlU1A9Wi3AJ/GKRRN4vv71hpOPRpog92Hsb+WNPiNitWleNAq64sOeBF0VyI6:kAR7/rRDyBhqXFQwqosleqTPWe
- TLSH T1AD52C82FA91069776CDBD22AF9227B93D7F5102222E51E84E7FCCA1C15E75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 8b0d938773d7fb2e98bf755f1bd037e4f7da68db286172aa33f2ccd11c7418f5
- MD5 3ece45b00dfd7e005f0009ff0357be6f
- SHA1 b49170f2c646aea6ca377596cf5566f5552f348d
- SHA512 e5508baa77c957ad9bd77fb139dac57e511d17dc7349dc72c7ce3bfe64200d2db8a4002bf98f5f42ec22025c2991c2a9dee8565038efb79329973fb00b5d10e4
- TLSH T170B01200C0015101C05202B4219E649C72156F10AA0F170653E0BD22CC255618424190
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d3e5.TMP
- Size 96B
- SHA256 62eed0fb4c04011040f6ba279cffa29200ef459d36bd515f3aa37a6187144176
- MD5 6b006d4d6c23baffe468ed3a6c43b479
- SHA1 d30ac6b6882fcd0b64e98568410199fee45ede64
- SHA512 b7f55dc6fd2d3f3838b687a5c698fb881235f501e9cec521859de386b4790f028fb2c303e2abba5aff00943e9d65ed3feff9345bd7da92ada00e6c5ae8846b43
- TLSH T1E0B02208C0022203C88A03B03888C3C83230EF2EC303020382E00EE3CC2223200200A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 eade064919ca3e2928eceb66cf7b51070353c349261bd8a3095a2b6bc6c575b3
- MD5 7c48f5b76c84e6490b3b5ebcff3fd266
- SHA1 248ee300b892fd580600639bdb79bf0cb33ac0fb
- SHA512 364eed29ed26d912843ea4245a058be828d57f32fd56b58ec6b10715e63b150dc0e0f0f7e3b83121ed5d7268eb413b841e6b74154c5914b1d12d8fc88f325cec
- SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:lm7Rkm1tYpBeh2BAo3
- TLSH T17CC312275E71E9375D79AB0EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 233KB
- SHA256 c2ce109b345d2c70ae8f97b55c2579a21f9ce2ae72b3a451e322c820fae4fae9
- MD5 ca1562a9fe618d2a4f0c9bcf5de96e89
- SHA1 fc470fbb6e14191b07a766580bf38acd7d95b17d
- SHA512 4b282c8e7a3ae9b4fbe630753c938f928cfa03669f10c1b193af82167f7102b9fc2fa25dfa2f77a42c4bbe30c68933f35c89eccbed77fab1087cace04edd89bb
- SSDEEP 6144:7JCe0T4THtKE+1HXlKM0Jm7Rkm1tYpBeh2BAot:D05X0MR9oBGcAot
- TLSH T1913412376E32EE7AD879AB1DF04F2F0F1EF15B56C920C9C6D8A87F0856DA6440443968
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 233KB
- SHA256 43d6d0ff643944bd3e3d3becd72cd1e8fb994a1a03d2c4a9d8d8924da2aaf12f
- MD5 24a11a46127ebf10a9ac86e7ab527130
- SHA1 fc30f8fd33b58f2edbfafb01b020c102c577fe37
- SHA512 905906550df8937d21f3df6e5249cc1ab3a17760bcaf7273b45ac4c3e6f5ea76b3167f99ca2e1a7a73b3777578d5db100d027f8f7012ce7ddea94ab9c863d24c
- SSDEEP 6144:rJCe0T4THtKE+1HXlKM0Jm7Rkm1tYpBeh2BAot:z05X0MR9oBGcAot
- TLSH T1F83412376E32EE7AD879AB1DF04F2F0F1EF15B56C920C9C6D8A87F0856DA6440443968
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 233KB
- SHA256 50d37ddde8821f92f5b3707439b0ea98443710ef6977bbdfe19641a4801cfd21
- MD5 b9b4e850597b555c26bb5729d5804337
- SHA1 1cc4b314273e318115ba3c90f12b5e0f96c5add2
- SHA512 bc86089c2baa472f6e6dbbe8bfee771deb45fbfd65d7293b88716f9aca87a2b16a4caff4a9ef2de8a9d7f834e64658e7756065354f975456b7749f0fad363997
- SSDEEP 6144:7JCe0T4THtKE+1HXlKM0Jm7Rkm1tYpBeh2BAot:D05X0MR9oBGcAot
- TLSH T1093412376E32EE7AD879AB1DF04F2F0F1EF15B56C920C9C6D8A87F0856DA6440443968
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 232KB
- SHA256 f3a3b8bfcf1fe6967b3fd672e974610299de8586d03aa55d81e8aa0ea5c2a299
- MD5 bae63cce89c0acb95b4b459811018045
- SHA1 75f7dcb1ffca5365ea6c879137d26681983b25cd
- SHA512 be6b370706f8fb203d7bf2ecf9b1046b77a068c65dad5286b70f2a2e5400a77da5d87da2d66241008a7579cef7cbaf3a04dc84c15de63472d65c5dd5de9585e4
- SSDEEP 6144:lCe0T4THtKE+1HXlKM0Jm7Rkm1tYpBeh2BAot:z05X0MR9oBGcAot
- TLSH T1123413376E33EE7AD839BB29F04F1F0F5EB14B558520C9D288E57F085BDA6890153928
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 232KB
- SHA256 3a71b89ba2050080e96c1001e7a4d167cfc5c0f60ccda33ed06a0d00225a5e79
- MD5 d658536da28459002947ea0e9c38bff3
- SHA1 39eae46ed6a1e1a4c179434ce4979784eab44fe1
- SHA512 7e2963bc16612f40cc7e7200b090f876ced344723495a429fd24b0cc3f1da520e655d8a13959f0b77e0cc9865b9d69c9f47a7c4adcfde66c32ec504835ee4505
- SSDEEP 6144:uCe0T4THtKE+1HXlKM0Jm7Rkm1tYpBeh2BAot:U05X0MR9oBGcAot
- TLSH T1AF3413376E33EE7AD839AB29F04F1F0F1EB14B558520C9D2C8E57F085BDA6890153968
- MD5 SHA1 SHA512 SSDEEP TLSH