Overview
overview
7Static
static
3Trezor-Sui...64.exe
windows10-2004-x64
7Trezor-Sui...64.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
1$PLUGINSDIR/app-64.7z
windows11-ltsc_2024-x64
1LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3Trezor Suite.exe
windows10-2004-x64
7dxil.dll
windows10-2004-x64
1dxil.dll
windows11-ltsc_2024-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/app.asar
windows10-2004-x64
3resources/app.asar
windows11-ltsc_2024-x64
3resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows11-ltsc_2024-x64
3resources/...ngs.js
windows10-2004-x64
3resources/...ngs.js
windows11-ltsc_2024-x64
3resources/...ity.js
windows10-2004-x64
3resources/...ity.js
windows11-ltsc_2024-x64
3resources/...ors.js
windows10-2004-x64
3resources/...ors.js
windows11-ltsc_2024-x64
3resources/...ice.js
windows10-2004-x64
3resources/...ice.js
windows11-ltsc_2024-x64
3resources/...th.exe
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Trezor-Suite-26.8.0-win-x64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Trezor-Suite-26.8.0-win-x64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app-64.7z
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral15
Sample
Trezor Suite.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral16
Sample
dxil.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
dxil.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/app.asar
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/app.asar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/usb/dist/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/usb/dist/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/usb/dist/usb/bindings.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/usb/dist/usb/bindings.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/usb/dist/usb/capability.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/usb/dist/usb/capability.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/usb/dist/usb/descriptors.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/usb/dist/usb/descriptors.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/usb/dist/usb/device.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/usb/dist/usb/device.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
resources/bin/bluetooth/trezor-bluetooth.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 19.4MB
- Sample260720-e1cwbaey2m
- SHA256 e3c8a6093358521d4512d68945e16338755e687619196e63948d46c9267537b6
- MD5 f18ed9a25df7c7951cb7f936ca9feeea
- SHA1 3ba65e050dbc1e365c6397d41edebeb8a4322794
- SHA512 8eccd9eceb7032504437cc95e01e5e040872db5951ed1f7f11f86c26f244c2ff2516d792b32ed3941a2a3170048725112005877bd76637a9d1b3fec548cc19f8
- SSDEEP 49152:52SFkMZThUZLQTYp281vCmh3r8xsJQfiFTuoYQdVi2Hxj37D4h:v
- TLSH T17127B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4200 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289954800104469" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 1740 chrome.exe 1740 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe Token: SeShutdownPrivilege 4012 chrome.exe Token: SeCreatePagefilePrivilege 4012 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe 4012 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4012 wrote to memory of 3924 4012 chrome.exe 84 PID 4012 wrote to memory of 4200 4012 chrome.exe 85 PID 4012 wrote to memory of 3516 4012 chrome.exe 86 PID 4012 wrote to memory of 3516 4012 chrome.exe 86 PID 4012 wrote to memory of 888 4012 chrome.exe 88 PID 4012 wrote to memory of 888 4012 chrome.exe 88 PID 4012 wrote to memory of 4440 4012 chrome.exe 89 PID 4012 wrote to memory of 4440 4012 chrome.exe 89 PID 4012 wrote to memory of 3840 4012 chrome.exe 90 PID 4012 wrote to memory of 3840 4012 chrome.exe 90 PID 4012 wrote to memory of 3672 4012 chrome.exe 91 PID 4012 wrote to memory of 3672 4012 chrome.exe 91 PID 4012 wrote to memory of 3208 4012 chrome.exe 93 PID 4012 wrote to memory of 1656 4012 chrome.exe 105 PID 4012 wrote to memory of 4968 4012 chrome.exe 106 PID 4012 wrote to memory of 2664 4012 chrome.exe 107 PID 4012 wrote to memory of 1740 4012 chrome.exe 109
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff7792c728,0x7fff7792c734,0x7fff7792c7402⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,17808558671690753940,12677719021780205500,524288 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2096 /prefetch:32⤵
- System Time Discovery
PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,13393924799307929410,4337811118037656297,262144 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,5162078981757686761,1600153068557127203,524288 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:82⤵PID:888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,11053090400407100575,4836339601115730107,2097152 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,2094079924785288491,9664271693040586653,2097152 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,7306758822916610722,17940217519865202367,2097152 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4468 /prefetch:22⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,2979848634903627093,17527900171584448940,524288 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:82⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,5788932521149059338,13749830852204857281,524288 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:82⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5728,i,4504340683682521833,13249215096158909637,524288 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,9937227045681960245,751091433940258648,524288 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4924 /prefetch:82⤵PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5724,i,18297824798236684203,16207163809395315627,262144 --field-trial-handle=2056,i,4181427378813581904,8128835593585046222,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 16bf0d638ffa47ab8057c09c27ba8826b6a0c32100ddefe175506e22f3183476
- MD5 490a7e637e33bffaeba7fb6d38ebac6b
- SHA1 1b39c18792cc0f47aa88d308c27914ec9a272274
- SHA512 ed4bcd4d993370fa32784970044b77ac331bd908e43b5b052702ad555acd34f84cae269c6252680e8a5af737a8c63e8a2da3882fd323f5ba9e29f817ae2bf076
- TLSH T19FE02BAAC922EC771CFD475D60910646EA6113571760845F3B3CC109CFB06670686C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 b1fef003ed450e8df40c2badbfdf12c19cdd89d911f977a3b596abbeeb5ebbcc
- MD5 e9a7cd9f3f04422cd51cd42144419065
- SHA1 46cda0b3d6a60b293ac24fcc16691987dd7782d0
- SHA512 ca9e0ce30707146c304101f1cb7b9b481057bc3574b7ef7350469ecab1f4983f6ba335b064bec92610bf49d185f24f31a0b9a7192606aad8bd89e91296fc646a
- TLSH T11141BEF793B4D57E8A0196F4EB156E1FCE6A0924032C7CA688D46E2B53F2972D10079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7e473f73c3e79995fc68435575c7d66b386a423fe9102a06c4efdb8767dd237f
- MD5 ddf980d44e7df547241311243abcfc4e
- SHA1 9d6fedcaf1a089902372397656552be09648ea7d
- SHA512 7fafc39881d1d16c91cef973068d2bfd088417200e36097b64ab8f257952ee6c51a4c63c407520ef9c857a12f151b87cc93a245b958f41482d5879128e600fe4
- SSDEEP 192:IR9GZAmG82nxv7ApAPRp2he9qHsb+WNn9NPU4edDUVyIsnAUge:IR9G2LhkUXXkw7Pqce
- TLSH T14D42C82AFE10697BACCBD229FA657B63E7F5103521902EC4EAFC891C14E75CC211742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9c58dc518669bd429df456e64ef705118a9896c426c4507f4924a25ef97aec23
- MD5 ab0de25cbb923d5b1345e00437bb38fa
- SHA1 77ea9471c4e680068076fdd24210c5ce95d40df3
- SHA512 257df0f8067d1ae593ad8ae633e812796b4b44e4ab087b5c51e7d445e84b5318bc9d8916825d44c8d8418165b1bd3670a2207e17a0d5b963222762b37c0f2dff
- SSDEEP 192:IR9GUAmG82nxv7ApAPRp2he9qHsb+WNn9NPO4edDnVyIsnAUgE:IR9GjLhkUXXkw7PMFE
- TLSH T13842C82AEE10697BACCBD219FA657B63E7F5103521902EC4EAFC8A1C15E75CC211742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
- MD5 28aca1b912d001e337a9e715a111a353
- SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
- SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
- TLSH T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 3b3677ab32e1a2c96b6fcaa9f3a26e3e9f6a5be08bf036f84e00ea9d3c6aa977
- MD5 49459da9c98781d28440626f05a621ab
- SHA1 055a07efc892f9940b925e50c6ab76bde70daac5
- SHA512 12eaac19dcda3843baf5f077c8e66a8fabd2c1a67f70892a5ae6d7b4b6444867de97361391278fbf2f9a0236cc896297a31d445678553ddce14c7f72817cbba4
- TLSH T14AB0124088016142C04606F811431488B116DF14A60A2F0543F1AE2298252508014053
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f9ad.TMP
- Size 96B
- SHA256 d6604a60407b0179b7b5e8bf8233c4eb50ad88b4971da200590548a3682e51e9
- MD5 526450820a963d8b7bb16587092784d4
- SHA1 96d7a03ed9e0ecf8844c2d3b12ece6a0b04ec4b7
- SHA512 005542faf394fd0ae070509db77313dc3f003a5fb39666e46db5db8b1ed5374a4ad2548e7d5664bdfe00fe04bc1a5a0e73019ec3d5ed90a74e6995c270700e49
- TLSH T15CB02200C302A222C00203F02AC0A0C830A0CF33C2032A0A82E00A22EE28AA20020020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 05dcfddf429514626eaa11b289d1c77cfb22be6629cd73a8e18254f28573184a
- MD5 ba98e2c76bb063a3cd0c72b46fa95ce7
- SHA1 cf712f8425ba8b13d0b883ddb99c678a95b50a4f
- SHA512 1ca6f9faf42da24e6a7f830e8c29bbd6f5557c78d98791e8a106175e6d8d0b51b3fd4562c5dbb45e333acd1b2db56be1d8638fec27d6725c0e00c1194b6d39d9
- SSDEEP 3072:BDGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Um7Rkm1tYpBeh2BAog
- TLSH T1DFC3013B9D75A8375DB9B75BA04E0A2E2EF249A7C920DE52C8D85A0433F97CC1A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 09f30b3e4ba1bc18aab110ab6180d7ac7f10b684e1035cbe32c4d18a7c06d628
- MD5 33c53e0d67089931d46c871e86678b73
- SHA1 3b1d4a7ab080a70fc7970af94c4a246dc6f170bb
- SHA512 076c7ca0c46af8239f3113b7884346af3667beea142629bc2733d50ae03ee52ab7c6c9e5e1bfee04ce837c726a9dab1e6da53856b69f11a8ef889cd139708655
- SSDEEP 3072:AZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:zm7Rkm1tYpBeh2BAog
- TLSH T1CFC3023B5D75E93B5CB5A74EB08E0B1E2EF249A6C920DE9288D85A0437F97CD0A44D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b299b69d832fd5d4192acebea59b33c66b8f386872247dc4ff0f9f8dae1ee2f6
- MD5 a52f3f724c987f4fbbb4abde3d14ff29
- SHA1 011d3661455c633f81dfc342689bb7856eba4642
- SHA512 21c376ea19f666e323e7f918505336efb392192caef1a210f53e37b91d67e0c5c5a55e0e9318be38964d42577094e10446258c9f282325da44e947d9f729c1a7
- SSDEEP 3072:BJGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:am7Rkm1tYpBeh2BAog
- TLSH T163C3023B5D64E8375DB5A71EB04E0A1F1EF249A7C924DE92C8D85B0433E9BCD0A45E38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 635f72906ca06cfc563288c54a5a32d74eb35f5295ff7535d9f9a990b6dda4d9
- MD5 32ba602943665ba2474629b5140e73e4
- SHA1 1b8606c96b1bfcf4dc25501ac8cfafdc6e0071bd
- SHA512 b80fc3a5875d6d673d321f2e757e3979b342fb07b62be81c6ae97f9962bc4104075a5cc98cf846a108d83c10f4de653beff040703c6e2907858223cd5b61818c
- SSDEEP 3072:iJGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:bm7Rkm1tYpBeh2BAog
- TLSH T1A4C3023B5D64E8375DB5A71EA04E0A1F1EF249A7C924DE92C8D85B0433E9BCD0A45E38
- MD5 SHA1 SHA512 SSDEEP TLSH