Overview
overview
10Static
static
3Velocity/B...er.exe
windows11-21h2-x64
1Velocity/B...x.html
windows11-21h2-x64
6Velocity/B...ain.js
windows11-21h2-x64
3Velocity/B...lua.js
windows11-21h2-x64
3Velocity/B...ain.js
windows11-21h2-x64
3Velocity/B....de.js
windows11-21h2-x64
3Velocity/B....es.js
windows11-21h2-x64
3Velocity/B....fr.js
windows11-21h2-x64
3Velocity/B....it.js
windows11-21h2-x64
3Velocity/B....ja.js
windows11-21h2-x64
3Velocity/B...nls.js
windows11-21h2-x64
3Velocity/B....ko.js
windows11-21h2-x64
3Velocity/B....ru.js
windows11-21h2-x64
3Velocity/B...-cn.js
windows11-21h2-x64
3Velocity/B...-tw.js
windows11-21h2-x64
3Velocity/B...der.js
windows11-21h2-x64
3Velocity/B...der.js
windows11-21h2-x64
3Velocity/B...min.js
windows11-21h2-x64
3Velocity/B...ipt.js
windows11-21h2-x64
3Velocity/B...64.dll
windows11-21h2-x64
1Velocity/B...gn.exe
windows11-21h2-x64
5Velocity/S...lua.js
windows11-21h2-x64
3Velocity/S...FE.bat
windows11-21h2-x64
1Velocity/S...ius.js
windows11-21h2-x64
3Velocity/Velocity.exe
windows11-21h2-x64
10Velocity/V...PI.dll
windows11-21h2-x64
1Velocity/W...er.dll
windows11-21h2-x64
3Velocity/r...er.dll
windows11-21h2-x64
3Analysis
- max time kernel
299s - max time network
305s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/07/2026, 14:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Velocity/Bin/Decompiler.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
Velocity/Bin/Monaco Editor/Index.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral3
Sample
Velocity/Bin/Monaco Editor/vs/base/worker/workerMain.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
Velocity/Bin/Monaco Editor/vs/basic-languages/lua/lua.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral5
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral6
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.de.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.es.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral8
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.fr.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral9
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.it.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral10
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.ja.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral11
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral12
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.ko.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral13
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.ru.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral14
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.zh-cn.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral15
Sample
Velocity/Bin/Monaco Editor/vs/editor/editor.main.nls.zh-tw.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral16
Sample
Velocity/Bin/Monaco Editor/vs/loader.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral17
Sample
Velocity/Bin/Monaco Editor/vs/loader.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral18
Sample
Velocity/Bin/Monaco Editor/vs/pickr.min.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral19
Sample
Velocity/Bin/Monaco Editor/vs/script.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral20
Sample
Velocity/Bin/VMProtectSDK64.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
Velocity/Bin/erto3e4rortoergn.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
300 seconds
Behavioral task
behavioral22
Sample
Velocity/Scripts/Favourites/Dark Dex,lua.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral23
Sample
Velocity/Scripts/Fun Scripts/Infinite Yield FE.bat
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
Velocity/Scripts/Fun Scripts/Sirius.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral25
Sample
Velocity/Velocity.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
300 seconds
Behavioral task
behavioral26
Sample
Velocity/VelocityAPI.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
Velocity/WebView2Loader.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
Behavioral task
behavioral28
Sample
Velocity/runtimes/win-x86/native/WebView2Loader.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
300 seconds
General
- Target Velocity/Bin/Monaco Editor/Index.html
- Size 322KB
- Sample260716-rn2ecsbs6y
- SHA256 f594177a1d87c2caaab344207dabb21cd044e1bfac5dbcb9cc4dec7cd4337642
- MD5 c6d8268b090b11d1cb06a924969f3033
- SHA1 fd9d1c74ecb6a3e4929b96ce1f6a587a3cc3ec57
- SHA512 dcb5fdd63172688d29bed31685b5a9bf811ab4e85bd8328ea1028298ceeab172f3b632985f94d5babd2ae8e5471999128ff721a61a892c72857d4e4eb59f9b01
- SSDEEP 6144:ujW4GZWXmponRPOVT5lFeicvmSA+HncLFhNyePWPkvU+OI7a5OT9l8pVp1fbl2Gg:ujgqoA6wfpI
- TLSH T1AA64100EF1251C1126876230669BBA18767044A3AD667F063FACD7142F9D29F61BB3FC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 21 raw.githubusercontent.com 1 raw.githubusercontent.com 20 raw.githubusercontent.com - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1084 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286854290159883" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 4452 chrome.exe 4452 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3408 wrote to memory of 5160 3408 chrome.exe 80 PID 3408 wrote to memory of 1084 3408 chrome.exe 81 PID 3408 wrote to memory of 5988 3408 chrome.exe 82 PID 3408 wrote to memory of 5988 3408 chrome.exe 82 PID 3408 wrote to memory of 5020 3408 chrome.exe 83 PID 3408 wrote to memory of 5020 3408 chrome.exe 83 PID 3408 wrote to memory of 1408 3408 chrome.exe 84 PID 3408 wrote to memory of 1408 3408 chrome.exe 84 PID 3408 wrote to memory of 2272 3408 chrome.exe 85 PID 3408 wrote to memory of 2272 3408 chrome.exe 85 PID 3408 wrote to memory of 5620 3408 chrome.exe 86 PID 3408 wrote to memory of 5620 3408 chrome.exe 86 PID 3408 wrote to memory of 872 3408 chrome.exe 89 PID 3408 wrote to memory of 3440 3408 chrome.exe 91 PID 3408 wrote to memory of 5188 3408 chrome.exe 92 PID 3408 wrote to memory of 5256 3408 chrome.exe 93 PID 3408 wrote to memory of 4452 3408 chrome.exe 94 PID 3408 wrote to memory of 6000 3408 chrome.exe 95 PID 3408 wrote to memory of 6000 3408 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Velocity\Bin\Monaco Editor\Index.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7c44c728,0x7ffe7c44c734,0x7ffe7c44c7402⤵PID:5160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,769636160341534504,17085063226726380270,524288 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:112⤵
- System Time Discovery
PID:1084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,14931965800078798684,17311000283488560987,262144 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:22⤵PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,2466967067283600924,11371836122932649286,524288 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:132⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3164,i,9912418708351198850,7799217683224831874,2097152 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,2406598087828015745,15411193617664084629,2097152 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,10627620770985532775,4265542791156897909,2097152 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:92⤵PID:5620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,799590605551726060,13886871296848972165,524288 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5264 /prefetch:142⤵PID:872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,8239054253358973613,18227538236976774352,524288 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:142⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,10645928966394504166,10734683077306997054,524288 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:142⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,13158931698280222761,18098092624176372783,524288 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:142⤵PID:5256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=948,i,13862337296833914418,13525160809549029495,262144 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4276 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,8775271526442607161,3326698604119802761,524288 --field-trial-handle=2016,i,12143177998352607904,4149696119667002080,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:142⤵PID:6000
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:6140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 98c39017701b291faa45fd03f63dc579186325274b6ca556f27760408a9b88a0
- MD5 a66d58edf3e6049ceab771bcf26380d6
- SHA1 362ab25b76700789cea0892254098780cdb31d08
- SHA512 18df79a23f9620c38c5c1cf8f82472fc97b2c20dc840a302de21b2857ea8dab773a18f3a703cdb9743620196840422582d873b40f30ffd3fec7893b9db93496a
- TLSH T1F7E0E5AFDD719C7714FC07586054468BE74413572A50589F7E3C860C4FB476A468A95C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 55ef68f9360fb3f7309c34ba869e287e1e0734d52732189b1fb4513d00ca7c7b
- MD5 ba2ec6b82a1f0d0e84b6a95ac7f85c91
- SHA1 5a111b7088b7fcfed6e9ba00110db936cf896bf4
- SHA512 c29f270582abd0c872ac33560e972c887e10353a880c836668197977e6694dd6160e7651a0e383e6846658be0bac7d55a24644ef07334b16adefd445f8f4f8d9
- TLSH T1D4519CF783F4867E861196F4AB256E2FCE6D0525032C3CA689E46E1B53F2872D10079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 97bd7e9d2916b0e69259d8be35a81abc593729f05f490cfe052e11c2b52d3587
- MD5 24b8c7cfba3af6a04dfcab4913e59d42
- SHA1 6b6963471e733d81fc52e89523fd305545d63ccf
- SHA512 2996dc0f51830e1537299cafbdbb26857e61637d28e45d750dda82bf1e554bb5aa65502d49a3de3fc1c6df4e7fe9ff07bbe0657b8caf652a0ee80135ed425a76
- TLSH T1B1417DF783F4867E861192E4EB256E2FCE6D0515032C3CA689E46E1B53F2872D10139F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 b2594cd01a537c406b147b4e6bde912ba7615980a9108e99b40070455255bced
- MD5 874bcc386e3b512c5dc8070b5284dd6d
- SHA1 b5e44aaaa586dfa9a5df0f0d446a3468b009f740
- SHA512 7fda24b1d293f20c468eb899ddafadd3dc2ea0b1e42a7d27a453047bfa1a16cb209595de747ede0dd5c258b06db3bcaffab27d4c62e6532021a0642531bb506a
- SSDEEP 192:XR+9PTbMOSKrKv7+pAPRp2ca9wHsb+WNngMPMIsPkwbaBQWQVyIsnAUge:XR+97wOxG6UXIOwlPYP7aOLe
- TLSH T16842B62EAD50793BACCAD72EFE257B93D7F5102121941E84E6FC8A2C14D75CD222712B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 996391fe1f0a8706ca562443122a913246d08130a170a291d8a318433247f457
- MD5 e12323ac79c0b84ae3128b6affd2318a
- SHA1 5349a7a67dc5dd697def28980fbf6b1b9c43bc1e
- SHA512 1e0cf529accb73acf44b332e5bfd7d7fa2261ab256df81a45a156cb119745c6fc60029efa74ff9d4397cc19f251e2a51fcd15488c15b47e55c2ecb0f3ec931d3
- SSDEEP 192:XR+9PT4MOSKrKv7+pOPRp8ca9wHsb+WNngMPTIsPkwbaBQWQVyIsnAUgE:XR+97hOxG6KXKOwlP9P7aOLE
- TLSH T11C52C82EAD50693BACCAD72DFE257B93D7F5102222941E44E7FC8A2C14E75CD221712B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
- MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
- SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
- SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
- SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
- TLSH T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 ac3cd61c15c21ea3a0c653def8878bc331f108bd4260f3af848348d854bfd7f0
- MD5 6c93639e2b2885361a968544984518df
- SHA1 a4d82ccc4d9afa131f4b7de2f1f86713db6d0c27
- SHA512 0dca8409850dc9414b4e5197d0c5cef40b45ecee5e5fabe67952f9ab863d2fcb26049dc457053908c29dc39f9324add254af2e3606913604427c450d8b3bdeeb
- TLSH T183B0128180036201C0460FFC214614887214DF14E70A1B0183E07922DC29651C014051
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58eb36.TMP
- Size 96B
- SHA256 f467162703459dd14e1073e414a747a33604b7cb72fd9515fc0e538b8072c8a7
- MD5 f17f0fa60926afa65f70d00ec2a03fae
- SHA1 6ae67562da011b656a895b96decdb3202c602181
- SHA512 035b10a83824f2ce3cb027a4dff882b777682d9e2e281f0fe736107176cbde9cacb58cd641267e55838cbe19dc9b5303429274d61d7df77c4012ecf4341fcc69
- TLSH T146B02200C2023302C08303B02CE080E83020EF30E203020AA2F03B22CC3A2300022820
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 63aaf7017e2093b61abb5813fa9c266ade1e0295ee6956744a28288dc38de8e0
- MD5 24c6c4949b2a06d032f9c51eeddbe6a2
- SHA1 9bf3ef94da9b87750be3164694839e750e0af624
- SHA512 ef5729953e3a2b6a000466ae1d3a89d81b89612761fcde845a4a56ac28f507df6983aaf84377ea761f78861850d46a3d0d757145e8b7ea9471f3c3471fd8d946
- SSDEEP 3072:EezWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:E8WDfxA3OnjrYQ9EU0/hEg
- TLSH T1EAC302A15C39BC660DF8EE99740D3E60AFF46C9B92875DC3A2E81F4C14FA5C8117A931
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 68369774a870b5239fe124c16782c9226e3dbb87d04e99161d21a2a01f169bef
- MD5 a6e48dc6e6c8523b34e26742048dff06
- SHA1 7409d94a79a1fcd20e5957ba0babc62467f01942
- SHA512 8100b67851ecd6b36a84057296340ae19568f32983728987c5f007e08d61efa08e1a8a6b3b7c94a2d022b7b2df59fb80678995fd8e4634d75ce4b612841a73ec
- SSDEEP 3072:8ezWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:88WDfxA3OnjrYQ9EU0/hEg
- TLSH T17BC302A15C39BC660DF8EE95740D3E60AFF46C9B92876DC3A2E81F4C14FA5C8117A931
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 faadc54852af9f617b43824c1baa710462d7248e309e4662327dc91fd35664eb
- MD5 338d394d3e3cd23f67865470e71548a9
- SHA1 bc96d497691c094d33967c7f46d006890bc5b3ea
- SHA512 e142df9658719d7ee4314e466a1711c47e9a91a4ee80abd7e82d4cf580cb31060799e38bae7edca4c8095cc4ad7d8e50f558e0f91c26b8f5f7243652c8175edf
- SSDEEP 3072:K7zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:K/WDfxA3OnjrYQ9EU0/hEg
- TLSH T1FFC302A15C39BC660DF8EE95B40D3E60AFF46C9A92879DC3A2E91F4C14FB5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 6f8eec47f7c726f6ca21089153ecc985f33dc6bf7b98f365191c2c39f87ca36f
- MD5 0cc95ad8cfc17e17ca7babfdc033584a
- SHA1 d12ea3216b03624b1304662a3347d0fb7448caca
- SHA512 8735dd4f8378d81bef88cd23a6d234330f28cb89f06116cce50c03c339910a66a58403dd1bd98a18df9bc7019e017911e471fb9655af6e8ef00a3e4265b8ae4d
- SSDEEP 3072:6zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:wWDfxA3OnjrYQ9EU0/hEg
- TLSH T186C302A15C35BD660CB8EE99744C3F60BFF4AD9A91879DC362ED1B4C24FA5C81139930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 13ccaa4b677a3363811307ad118f391d1528c0b06bf58132bc182e2845de5bd8
- MD5 e183e4157a0b7c4208655511177b8920
- SHA1 dce1e02a777f735041b157b79bf4662d652912f5
- SHA512 df71bc47822b1fc293dbce87121fc248a8e8acce933b63b3c40363da237136b14570619c2afa598bf3d2de59ab75fecd0188a46db91e6b832ec1d19e68a1263e
- SSDEEP 3072:H7zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:H/WDfxA3OnjrYQ9EU0/hEg
- TLSH T1D2C302A15C39BC660DF8EE95B40D3E60AFF46C9A92879DC3A2E91F4C14FB5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH