Overview
overview
7Static
static
3PAW.Setup.1.0.0.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows11-21h2-x64
3PAW.exe
windows11-21h2-x64
7d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninstall PAW.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
- max time kernel
900s - max time network
886s - platform
windows11-21h2_x64 - resource
win11-20260513-es - resource tags
arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows - submitted
21/07/2026, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PAW.Setup.1.0.0.exe
Resource
win11-20260513-es
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20260513-es
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win11-20260513-es
windows11-21h2-x64
11 signatures
900 seconds
Behavioral task
behavioral7
Sample
PAW.exe
Resource
win11-20260513-es
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral8
Sample
d3dcompiler_47.dll
Resource
win11-20260513-es
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
ffmpeg.dll
Resource
win11-20260513-es
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
libEGL.dll
Resource
win11-20260513-es
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
libGLESv2.dll
Resource
win11-20260513-es
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win11-20260513-es
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral13
Sample
vk_swiftshader.dll
Resource
win11-20260513-es
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
vulkan-1.dll
Resource
win11-20260513-es
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral17
Sample
$R0/Uninstall PAW.exe
Resource
win11-20260513-es
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-es
windows11-21h2-x64
3 signatures
900 seconds
General
- Target LICENSES.chromium.html
- Size 8.8MB
- Sample260721-ebrceaft7z
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- MD5 2675b30d524b6c79b6cee41af86fc619
- SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
- TLSH T17B96A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4196 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290798911086020" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 4912 chrome.exe 4912 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe Token: SeShutdownPrivilege 1320 chrome.exe Token: SeCreatePagefilePrivilege 1320 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe 1320 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1320 wrote to memory of 4688 1320 chrome.exe 79 PID 1320 wrote to memory of 3428 1320 chrome.exe 80 PID 1320 wrote to memory of 3428 1320 chrome.exe 80 PID 1320 wrote to memory of 4196 1320 chrome.exe 81 PID 1320 wrote to memory of 4136 1320 chrome.exe 83 PID 1320 wrote to memory of 4136 1320 chrome.exe 83 PID 1320 wrote to memory of 2600 1320 chrome.exe 85 PID 1320 wrote to memory of 2600 1320 chrome.exe 85 PID 1320 wrote to memory of 4976 1320 chrome.exe 86 PID 1320 wrote to memory of 4976 1320 chrome.exe 86 PID 1320 wrote to memory of 2268 1320 chrome.exe 87 PID 1320 wrote to memory of 2268 1320 chrome.exe 87 PID 1320 wrote to memory of 1748 1320 chrome.exe 88 PID 1320 wrote to memory of 3464 1320 chrome.exe 90 PID 1320 wrote to memory of 2976 1320 chrome.exe 91 PID 1320 wrote to memory of 4092 1320 chrome.exe 92 PID 1320 wrote to memory of 4912 1320 chrome.exe 93 PID 1320 wrote to memory of 1136 1320 chrome.exe 94 PID 1320 wrote to memory of 1136 1320 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5b09c728,0x7ffd5b09c734,0x7ffd5b09c7402⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,10112711190513689197,864809726979574254,262144 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:22⤵PID:3428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,6897201992411100629,5222083117886758469,524288 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1836 /prefetch:112⤵
- System Time Discovery
PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,17898494564227812325,12487705097141040400,524288 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2348 /prefetch:132⤵PID:4136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,11204263494580541491,12507293737260128553,2097152 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,11139897232154410261,12753839722874927717,2097152 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,14223252710057388479,13582113329653980557,2097152 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4340 /prefetch:92⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,15858539922466725178,13824338446616979445,524288 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:142⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,14714805328779221412,14861081379868612732,524288 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:142⤵PID:3464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,4428920793557478920,13227709022922954358,524288 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5284 /prefetch:142⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,13990402914183957377,16796619581759139989,524288 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5452 /prefetch:142⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5624,i,14678608751895137886,10890016026650547471,262144 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2832,i,18440105217874131544,3124349518726698683,524288 --field-trial-handle=1972,i,1504971428377112908,10910592772790826028,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:142⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 ea9752b4292fac871ed89b8606b2e3d5abc28191a8c3ffddafbf3faace116781
- MD5 f870f6a77c5375b4c5486a5c732f6716
- SHA1 31e1f4b5a083afa449a2fd194291fa3d9db1a7ff
- SHA512 ac199b4fd9d8fb3c98d51108460102fb688a0fad942ca6a474303b30bd30043063536e5261f890f753ef1e164fba224744b2aa8497d211664f93cd5825273d7f
- TLSH T165E02BBBCE219C2B1DFC071865444A46EB0013A76750490F7A3E820D8FF16364581D1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 286e8b116443353a008a43dde7ef1b2845987e5913378ec21e032ac90ee36110
- MD5 0647adb2d83dc678c9db8aeceecddf11
- SHA1 88051d99179f5d58fe98f48fa0b4308cb7dabb22
- SHA512 e7f469e71c52a73a13339af7bcfd4a0efab269b5eca917c4f109479130ce5206d3af539f22af12d6787aca549cf8e9a95e4995df92f047cfc929a105dc6d3fdc
- TLSH T17E419BF793B4957E8A1092E4EA156F1FCE790624031C3CA6C8D46E2B53E2872D10079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 0080b3114d457265423a372b9ed6e3646f8a3ad1ba10a921402534f53600d789
- MD5 a71815b1e74acb74e16219cbc1d82be4
- SHA1 4043bd7fae9db83c1872a006b01292eaf6383e35
- SHA512 8be53c92731ca6e289dc1e6ecabf8de96bfed6165cfbf97ab95038ac78ce09d8bf84ba799f8e50ec9a05626df0a05aa7e611511346d4fba17f97df7fcd5c4192
- TLSH T1E6418CF793B4997E8A1192E4EA156F1FCE790524031C3CA688D46E2B53E2972E10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 da4787b50a5877dd837a62613149d19947100de3f8ff18fb8d62f64ed4ea2708
- MD5 083fbdd92e5307a51d6fa32d220aa5b8
- SHA1 9be2b355e3e107c5f154c8f47caa73851effae67
- SHA512 3a540ed751b38f0231aa6935077eff9e5257774ae65f44f4156a8967944763b3366edbacbb30ae6d28520e4378c7df1ac61ea677f0103bf944cc1f2a671154df
- TLSH T10141BDF787B4957E8A1096F4EB156F1FCE690524032C3CA6C8D4AE2B93E2872D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 521B
- SHA256 47f79fd22cb3ef904bf111578da54b7639873ea53633de6a4c9b7678a17b0247
- MD5 3bcf69511795c0357dbb44ed0b42d360
- SHA1 fe1eeecddc3fc0225851e492b334a0e24857c81b
- SHA512 4ed6d9c85e051cdde4d4e2f9a8a85fbc68b67092c98d6c742247df042b8d2e7622124355671f6e2cbf60667af51e468fbecf8c913fba683bbf4ed6138d7c5112
- TLSH T141F05967E7A9709750FD05AB1E24BC0928B5B8310681ACE1CE7E927CE0928F30B06863
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 dd7de7e183b280d68dfbd86d312ab5d4dc8194842a5a178ae809febe0c46f836
- MD5 4aeb7e741fe09cc26985b8ea6ae15a67
- SHA1 b81867f9833357c25471a5b42bfda62a3e033977
- SHA512 3c33c75ef43711c38fac25bda5957746a353fbf5f6bcc1918a608d2c00b30806e9dc40bf7197e62ec9772cad6b7f9f02d262b89f27208c55b9ba1c5a075aa438
- SSDEEP 192:NRRf1AEo7+Qhv7sBpAPRp2t69NHsb+WNn0kPgEQTNkwka4VyIsnAUge:NRRNFux8UX7rwzPmEace
- TLSH T1F642C92FEA10657B6DDAD22AFA22B753E3F5102131D42E88E7FC8A1C15D75CD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 337288fb4e170d904cff3a71b8b0e9d1909127104c1a81fff297c4cfe7d16e51
- MD5 e85be6ef9a1aa4cc427cd2f4d2d68d9d
- SHA1 69f46e5574a48d2e9a1cc98eefe83960ae401ec1
- SHA512 56a2c07ca9023b20ad03d43292e7dbb4b18af6eb299a996df111856f3341868414c8f650de65cb52039469c57797d377a0bbb50989a453facb9b0b544fd87996
- SSDEEP 192:NRRf19Eo7+Qhv7sBphPRpNt69NHsb+WNn0kPtUEQTNkwkazVyIsnAUgE:NRRNmux87XGrwzPEEaVE
- TLSH T1F052F92FEA10697BACDAD229FA12BB53E3F5102131942E48E7FC8A1C15E79CD2317417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 f636bb229003202ee5f74b9badf2409eae06b618253d3d6b3483673109f479c1
- MD5 6b63d939942d0ceb3d72606240d3cf70
- SHA1 01865261884b4c309d6cbcf12f06ad345b3c8a77
- SHA512 116362ee7a2dca1b0b426ef6f1a6e1c87ef383041991eb9d0a2e0310f8be078da2a09595c7ea0b69f786046124ab5727d92c61d4e52a5fdd122c3dc77f42c27c
- TLSH T1E2B012508043A9A1C00306F81A421498B118EF11BB0F170143E0BA6288256508016051
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e1a1.TMP
- Size 96B
- SHA256 ab0a1b34ac62371204df238978ff8c02c67496407617760138374b0cfdb86575
- MD5 bcbcb318b9a5d2a1c07c6de754d49d85
- SHA1 93d28ad2480aa9d47a17c592b544d0a4cde0cf62
- SHA512 7a77e19ff931a4459e0b110aa34ecc479b1eae385bf5737cde9b4610151435a44009956bfa7558c107a50d7dc054054a9ecc0e91862556005c4c1e0be5d6c02a
- TLSH T1A7B02208C0023B02C08F03F03CC0CAC830B2EF20CA03020282E00E22CC20AA00822220
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\acf23386-c98d-4ccd-9c2e-2b0f7798ffa8.tmp
- Size 17KB
- SHA256 219db7acf380c142a244fd11d2def059b6c8fc454e0d1f267f3170f83d8f20f4
- MD5 6829413167491e65583f4bbd120f3ba3
- SHA1 13fcd5864497cf2d1561d82a3f2afb41116cd9c8
- SHA512 22c4813d0f7309f4d63bde121919cb6b4ab623c4dc8b048501dd9e934dd890260eee5efc595875026c6ca72c540a8f457811ca6bb99d7796439ae3ae6485c3e1
- SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLILc2j5EXODtw+ErU3UlH14wnTGv:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pg
- TLSH T1EF72F9A76C4C8E770F94CACCD817BB4FADB5024B65E9C86447FA581903D5BCB110A1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 c3068a4bd876d79999b4655e09719fd38c9633f0ad088a2cbbdcb6eaa4e90cf3
- MD5 4c56466414d8ec910ce4b3551f6af4f0
- SHA1 c962bf108d91d4b7ad604af387729eda5643ac63
- SHA512 1ea76bba558b9c290a3e5fe609fe1899edfa6bf8fe717a6fef7324abb57af1c9c4986f11493bb3d340125aa04918bc40fc5bba222305cc4ee67a83b0c30a6307
- SSDEEP 3072:WzGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:WKm7Rkm1tYpBeh2BAoe
- TLSH T13DC3123B9D68A83B5CB5B71EB08E1E1F1DF149A7D924EE85C8D85F0423E9ACC0645934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 fd4ef1f13028a7b66ec072623ade5d9696f09ed0b45751a668c991923e03425b
- MD5 cc0c0221eea642c2c51d20f7701385b5
- SHA1 37250a911c205cfe11377c7818cbc72a02bb97c6
- SHA512 42010f06ef3d4f9b5132cc238f0373fb5e50a6d1e9938fa1e556e6ebcd10c7cc5ab6772f8969f5c7f12d9d21c901d62b2067b96c8a05fdc261c2d231562699e7
- SSDEEP 3072:SGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:lm7Rkm1tYpBeh2BAoe
- TLSH T196C3123B5E74A83759B5BB1EB04E0F1F1EF149A7D924DE92C8D85B0423EAACC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 156KB
- SHA256 0d25bb0b2d2983c43677b2afdde58f562727ce8f6e0babddc1bd6f1b8455d7b3
- MD5 3d239b1deddbf785d7e65305028a36a9
- SHA1 7eccbaad9c2465bf9b3d06e52c28e6a580cc3c69
- SHA512 f1c882fe7e959042fbfc471056844114bfb8f76c9515190a0b92f81951d4e7886ed3ecf24dcedd4b3cf8a3ee4e3c6ebfeb56e29099e25248b10d2c375f58e898
- SSDEEP 3072:R5bKX4+GjrGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:Ph+Gjym7Rkm1tYpBeh2BAoe
- TLSH T17AF312375D78A93B5CE9661EA08F2D2F1AF25AD2CD20EE51CDD06B0073B57CA1A12D70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 24552b816749a51d72964a15dfc10067881f0455460b7566a27a71b11453d782
- MD5 3b769dc92e3a842452b35b0065052611
- SHA1 fb64880bb083785efd33b9d26d65927f26ea37ea
- SHA512 0762960b2ed67bed56084f63086f39da659eabbf906a03a74aa5232c1906afbf95de4d412318dbaf0cc0f215216f00dcccca8e0662382448f9f9ca1c518652dd
- SSDEEP 3072:IGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:jm7Rkm1tYpBeh2BAoe
- TLSH T1B4C3122B5E75A9775DB5B70EB08E0B1F1EF14EA7D920DE82C8D85B0427EA7CC0A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 e496cef2968fb3913a6878196c5ff338de8ee0a33822c6c7ae3c2f64ba3b5e8c
- MD5 b86efa05b663e61e95da97c36ec202a1
- SHA1 29cc07553b1c4bc135f6a905fe0cd4e874bc5855
- SHA512 2d44347562f1105670dbd9e4a62431be7b09a3803756374c0d67a897e55f2d97f793cfe93c98d60d3f15afb63736b05eb2c6f2c084bd24c7e6a563ec51ce230a
- SSDEEP 3072:HGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:mm7Rkm1tYpBeh2BAoe
- TLSH T1F2C3123B5E74AD3759B5BB1EB04E0F1F1EF14AA7D920DE92C8D85B0423EA6CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH