Overview
overview
7Static
static
3Silent Cli...64.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
1LICENSE.electron.txt
windows11-21h2-x64
3chrome_100...nt.pak
windows11-21h2-x64
3chrome_200...nt.pak
windows11-21h2-x64
3icudtl.dat
windows11-21h2-x64
3locales/af.pak
windows11-21h2-x64
3locales/am.pak
windows11-21h2-x64
3locales/ar.pak
windows11-21h2-x64
3locales/bg.pak
windows11-21h2-x64
3locales/bn.pak
windows11-21h2-x64
3locales/ca.pak
windows11-21h2-x64
3resources/...er.dll
windows11-21h2-x64
1resources/...on.svg
windows11-21h2-x64
3resources/...go.svg
windows11-21h2-x64
3resources/...go.svg
windows11-21h2-x64
3resources/...r.html
windows11-21h2-x64
3resources/...ter.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...nt.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
605s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/07/2026, 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Silent Client Setup 4.4.2 x64.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
600 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
LICENSE.electron.txt
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral8
Sample
chrome_100_percent.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral9
Sample
chrome_200_percent.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral10
Sample
icudtl.dat
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral11
Sample
locales/af.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
locales/am.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral13
Sample
locales/ar.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral14
Sample
locales/bg.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral15
Sample
locales/bn.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral16
Sample
locales/ca.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
resources/assets/icon.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral19
Sample
resources/assets/images/full_logo.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral20
Sample
resources/assets/images/logo.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral21
Sample
resources/assets/updater/updater.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral22
Sample
resources/assets/updater/updater.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral28
Sample
$R0/Uninstall Silent Client.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
600 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target resources/assets/icon.svg
- Size 86KB
- Sample260723-2vr5dade59
- SHA256 ad1d859b9f2f5b7dcecd6b199a96b6bb164655b33b9545506f1479c94899fcfd
- MD5 d22bf1aee0486d9ce98e69e9507fd357
- SHA1 62b828b051b4773185d0414905574e9b8b17d235
- SHA512 dfae09b7871f26e0aeb12799dd60ff79e61b590d8e3537caa3aa2a898f75788465a9780360ca4fbfba192d1f76ffff766d3113ccca610b5ef967b5420cae13e3
- SSDEEP 1536:yxzVcjBgQybTGNYqJkLbG1uokIOOKr4r85ujR7b7TJVHeyH9qEW5j4Q8T2yeBvzb:yxKjyGgqSOWGR/7TPeyH04AyeJzb
- TLSH T1D593F1B6565874CE29989E3EF23C2A44AC35613756D062CDFFC11102B0F8D0DF6AE796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5560 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293210761839526" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 5276 chrome.exe 5276 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe Token: SeShutdownPrivilege 4392 chrome.exe Token: SeCreatePagefilePrivilege 4392 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe 4392 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4392 wrote to memory of 2908 4392 chrome.exe 79 PID 4392 wrote to memory of 3588 4392 chrome.exe 80 PID 4392 wrote to memory of 3588 4392 chrome.exe 80 PID 4392 wrote to memory of 5560 4392 chrome.exe 81 PID 4392 wrote to memory of 992 4392 chrome.exe 84 PID 4392 wrote to memory of 992 4392 chrome.exe 84 PID 4392 wrote to memory of 784 4392 chrome.exe 85 PID 4392 wrote to memory of 6072 4392 chrome.exe 86 PID 4392 wrote to memory of 784 4392 chrome.exe 85 PID 4392 wrote to memory of 6072 4392 chrome.exe 86 PID 4392 wrote to memory of 5232 4392 chrome.exe 87 PID 4392 wrote to memory of 5232 4392 chrome.exe 87 PID 4392 wrote to memory of 2504 4392 chrome.exe 88 PID 4392 wrote to memory of 1060 4392 chrome.exe 90 PID 4392 wrote to memory of 6132 4392 chrome.exe 91 PID 4392 wrote to memory of 5440 4392 chrome.exe 92 PID 4392 wrote to memory of 5276 4392 chrome.exe 93 PID 4392 wrote to memory of 3336 4392 chrome.exe 94 PID 4392 wrote to memory of 3336 4392 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\assets\icon.svg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc182cc728,0x7ffc182cc734,0x7ffc182cc7402⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,149674991694434278,17606200856653499372,262144 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2056,i,5424608197625683088,11519631718104030315,524288 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2168 /prefetch:112⤵
- System Time Discovery
PID:5560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,15363629523475311547,17891827665175611959,524288 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2420 /prefetch:132⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,3360596007969597004,6579497679126675823,2097152 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,6014937427714538305,3546374728087116309,2097152 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:6072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4224,i,5520536598383808121,5898699695020458932,2097152 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4196 /prefetch:92⤵PID:5232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5200,i,9161917673695974360,6029841382526356788,524288 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5196 /prefetch:142⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,7696134903219981548,516950392496619070,524288 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5308 /prefetch:142⤵PID:1060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,16531402753135909266,4205151682715291747,524288 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5460 /prefetch:142⤵PID:6132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,13298029231264027081,545686421264362565,524288 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5524 /prefetch:142⤵PID:5440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5432,i,14350118295206172664,1860623282610232247,262144 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4260 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:5276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1496,i,13855403159116192794,10343853319512157274,524288 --field-trial-handle=1952,i,15905972818175952274,15257340037365085148,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3596 /prefetch:142⤵PID:3336
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 6a995df0d75849c11af11d88934c8a2bab2ca16b1582e7591084a6f6f5e06d0d
- MD5 e976a6b8752062df21efbb9889bc1b21
- SHA1 1f34d9d84daaed80a5374d5c2c73a84bb79a7bc6
- SHA512 f32e0f9d54245fae0b877616d760e2b287a17dcce603cdd46d372f4bb6d03d6dd4498d06efced46e4fa68ea606ffcbc5e4ed4db9f3a8585bbf9da136ed20f02f
- TLSH T1D9E02BAACD219C3719FD476860105641E74013577781490F363C920C8FF86774A55C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\80661583-8304-4cef-9ff8-dda4c041418b.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 9b285cbf92e0fab99ba780949508284a14fee1488fa8d55c550cd011ef73162c
- MD5 c985fc9ed429ecf50bbc3d9529638c6a
- SHA1 402213140380e426900a513bf0af96fa0c13c7a8
- SHA512 cc5c44b4cb3b8fc88b7757a79d7b0c689c22297e76ae580295d91879e4fc49845e916b5acba6fbdada9b20672c3a74f027aba5be5d52080130951c793cf9efdf
- TLSH T11941BEF797F4957D8A1196F4EB156E1FCE6A0524132C3CA688D46E1B83F2872D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 a9b5802e516ac1aff65aa86818527160574084f6a55ba7432eb7284bd6a940a1
- MD5 7f329c9d20052301fa2d83f85dd548a4
- SHA1 26039a426a15b69a1810646aac025ae769de37c1
- SHA512 e45d010f58960c272f19c98819974143d233711d2d1ca132cde2f7774ff05cc2880e820d171e3bbf067976977f0a70b1b1bd3518ae6b4abe75cc665c99500dc5
- SSDEEP 192:nRXgFtrK910Owv7lpupAPRp26Y9fHsb+WNnIoPVAWagbVyIsnAUge:nRXoJQsZgUXwRwZPnaKe
- TLSH T1B442A42EF950693B5CCBD32AFA21B753D7F5112521942E84EBFC8A1C28E76CC2217427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 910bce5cb7b0e34be402373a9b8413012bf05ff797068c22ccd8f0c5d8572cfb
- MD5 3b649433020ed329cf85c1bd458873cd
- SHA1 73949bc1c060ae23a6d9f1f2b284a89f2a5b9a3f
- SHA512 8c0d8daed03f75ef50b72420957e7c29ff4cea978907a4b584379c23e7d7cb80e213efe0c309864b7eeb7b82196410293815a8e3c15505b830faafd488c8598b
- SSDEEP 192:nRXgF0+rK910Owv7lpupAPRpO6Y9fHsb+WNnIoPwAWaghVyIsnAUgE:nRXo08QsZg8XYRwZPmasE
- TLSH T18252C62EF950693B5CCBD369F921BB53D7F5102525942E84EBFC8A1C28E7ACD2217027
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
- MD5 5d35f09b8c86835fb4877dcd0cc40e4a
- SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
- SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
- SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
- TLSH T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 cfa42121ad0c844f7bfbd9b4e4104647ef1a0c6cde1977855dfe7920528e8d3a
- MD5 890af9c1a8eb2a7bcd04041df5b43cec
- SHA1 96c2b4d40844a05216ede6da2b777d7ba377b653
- SHA512 45e6824b17df2adddbf735d0e7a7b0adc8c561138140e073c361bc77888b24129bd1647585a3e06e48b362eeaa5521b333373318d842fe1de6cbb0618df56757
- TLSH T1F1B0124180019103C81302F811435898B165EF10BA0B2B0143E06A22A8271D0C01C050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58818f.TMP
- Size 96B
- SHA256 ed16302bd226289b6e87224793e2fb2b94bbe98f9cc22926b30770ff1dbffe5e
- MD5 c808936c6a54a27ca2379c7cc18bed18
- SHA1 563fd517c503948e03e18203cc4895f6a2c4d8d8
- SHA512 78ae0f219b7a788c6761633d07c3b26d1168fa91dbf118886c59c1141a85a6302e372f140561d8c3edc0317185db6faa77dcb3abbb86a74f0805a5f02c40047c
- TLSH T197B02200C202B2A2C00233F028A0C0E83030CFA0CA03222282F00A3ACC38A2002282B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 c0c0cd8cb99074f9a1fb643ac2fbc10628a59b448d27561669c0363ed4c6b274
- MD5 32fccfaf0e5cff9393a62901493f395f
- SHA1 15f08e7c51e432c5cfba9eab1dcdce5479517153
- SHA512 e2a297071816e2a544c49bb8dd5e1b6012c1612aa89beb67c4eb3f0246adb769d79ce2fe3c95cf84ab85e90997dad992e5672f6cba5648f548131ebd3c3d0acc
- SSDEEP 1536:BoaoueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95hy:3DDFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T155C31212CEAACE9BE5E46C79A0C513F3AEBE4F9527F1B9428176A4423DCE7441391730
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 7d53805b77e5e09e9a039cd98b0c518a66e0431fe2b1a84a14e6d8dcc95f7e1f
- MD5 8e989cb29a6750a43c8cec97589412a3
- SHA1 0fd3a8799722bd5846728fcb183dbbe4d6b60926
- SHA512 645ec5e79246fa081d9d615f1173feccdb94598d46357bedf2c315a328880fe62dd1d8ea77e6d154f2ab1b6efc9618eec37f120b11c5ea54feb8283e029c0c89
- SSDEEP 1536:1XSueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:F9DFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T1AFC30212CEAACEABE5A49C75E0C513F3AEBE5FD523F1B9424166A5023DCE7041395730
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b836f443519308c960395dd8b37825b873b5c2d49b2e41bd26babb3012a381e0
- MD5 ea6dc4e85bb81c08064ec172cab410ef
- SHA1 8d1eb12ee7ebc42ace497c746cab6f220256df5c
- SHA512 b90f163a579be7d6a38a18a1b71f137d7d2d0f073ae9ec6a048d8b3900aa2de11953052dd3d9f66c8790d3b3de687deff8cf222818b67d5e2578fb3831aba093
- SSDEEP 1536:1oaoueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95hy:7DDFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T1ABC31212CEAACE9BD5E46C79E0C513F3AEBE4F9527F1B9428166A4423DCE7442391730
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 2e9ccbfab69a50353100c7c47918ece7af7dc1c59e1f3b14968743c0befdf6ee
- MD5 db499cdb9649a68c74e55755a9cb9d2f
- SHA1 7e917d423c63e9b7ac7ee0208c28fd0a88a2e02f
- SHA512 42e77c8cb6665c9204ded1868858a8d60665616a1417dd608acb2dff9890ad5c98176b5e76b986eca8163f960ce68193725d5b619a9df2bbf3012017f71f2ca5
- SSDEEP 1536:ncueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6mq:vDFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T1B0B30212CAAACE9BE4A45C79A4C413F3BEBE5F9523F1BA424166E4023DCE7042391770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d44674e3eb55d0eb01f69f0e40c30d85bbdf41f578a3d523ed062458c5f38ab7
- MD5 bfe09eac219a2fab9ea70abe7e20ab21
- SHA1 08dfb9a8dbc158efa6b308d54c1eeb5fd2839ba6
- SHA512 e9e3b637fe2c70f78855654fe7c9e6b1714f09f465b79cab6ed1b204a04869020756339e4fa96fddb8e5b42c447ddafb258c785619d033b0dee25c28146f390d
- SSDEEP 1536:GXSueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95h6Z:69DFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T123C31212CEAACEABE5A45C79E0C513F3AEBE5FD523F1B9424166A4023DCE7041395730
- MD5 SHA1 SHA512 SSDEEP TLSH