Overview
overview
7Static
static
3Silent Cli...64.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
1LICENSE.electron.txt
windows11-21h2-x64
3chrome_100...nt.pak
windows11-21h2-x64
3chrome_200...nt.pak
windows11-21h2-x64
3icudtl.dat
windows11-21h2-x64
3locales/af.pak
windows11-21h2-x64
3locales/am.pak
windows11-21h2-x64
3locales/ar.pak
windows11-21h2-x64
3locales/bg.pak
windows11-21h2-x64
3locales/bn.pak
windows11-21h2-x64
3locales/ca.pak
windows11-21h2-x64
3resources/...er.dll
windows11-21h2-x64
1resources/...on.svg
windows11-21h2-x64
3resources/...go.svg
windows11-21h2-x64
3resources/...go.svg
windows11-21h2-x64
3resources/...r.html
windows11-21h2-x64
3resources/...ter.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...nt.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
608s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/07/2026, 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Silent Client Setup 4.4.2 x64.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
600 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
LICENSE.electron.txt
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral8
Sample
chrome_100_percent.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral9
Sample
chrome_200_percent.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral10
Sample
icudtl.dat
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral11
Sample
locales/af.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
locales/am.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral13
Sample
locales/ar.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral14
Sample
locales/bg.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral15
Sample
locales/bn.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral16
Sample
locales/ca.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
resources/assets/icon.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral19
Sample
resources/assets/images/full_logo.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral20
Sample
resources/assets/images/logo.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral21
Sample
resources/assets/updater/updater.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral22
Sample
resources/assets/updater/updater.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral28
Sample
$R0/Uninstall Silent Client.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
600 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target resources/assets/images/full_logo.svg
- Size 7KB
- Sample260723-2vr5dade59
- SHA256 57492f2cab5858e746ff51282ffe5b9e9636c0313114e9051d3898a46dc2dd3a
- MD5 3a1ce5da249d01d6dbadd602223674b7
- SHA1 3026dcf6ee2e84e2d42d9a4cfb97b06712ae7f0e
- SHA512 c401170ae2e7cc76c5051b22de056d0c9e43688e7a0319b9ef987243ed258af8b0bb0ba513dfc4643b4c34cd77aefb7bb32a7478f2134b8b53b0808d570f3bda
- SSDEEP 192:CNv2uilYt9Nn7Dphcsh2Svk0X8Sg720t9m0MlVGHC:vUPldhRhTNMDXo5
- TLSH T1DBF110FEAFB11CE19D89CAD2EA2345EC750B597B6F528B10C229C7353907C9CC855983
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4156 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293210849015927" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4700 chrome.exe 4700 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4784 wrote to memory of 4652 4784 chrome.exe 80 PID 4784 wrote to memory of 4152 4784 chrome.exe 81 PID 4784 wrote to memory of 4156 4784 chrome.exe 82 PID 4784 wrote to memory of 4152 4784 chrome.exe 81 PID 4784 wrote to memory of 1792 4784 chrome.exe 84 PID 4784 wrote to memory of 1792 4784 chrome.exe 84 PID 4784 wrote to memory of 1372 4784 chrome.exe 85 PID 4784 wrote to memory of 1372 4784 chrome.exe 85 PID 4784 wrote to memory of 2068 4784 chrome.exe 86 PID 4784 wrote to memory of 2068 4784 chrome.exe 86 PID 4784 wrote to memory of 3852 4784 chrome.exe 88 PID 4784 wrote to memory of 3852 4784 chrome.exe 88 PID 4784 wrote to memory of 2364 4784 chrome.exe 89 PID 4784 wrote to memory of 3792 4784 chrome.exe 91 PID 4784 wrote to memory of 4408 4784 chrome.exe 92 PID 4784 wrote to memory of 4500 4784 chrome.exe 93 PID 4784 wrote to memory of 4700 4784 chrome.exe 94 PID 4784 wrote to memory of 780 4784 chrome.exe 95 PID 4784 wrote to memory of 780 4784 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\assets\images\full_logo.svg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae8d0c728,0x7ffae8d0c734,0x7ffae8d0c7402⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,14886513145627457303,11252482163778857887,262144 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:22⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,11000947151738816805,16292991298145131490,524288 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1824 /prefetch:112⤵
- System Time Discovery
PID:4156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,1445896571047122075,12067139847431866625,524288 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2380 /prefetch:132⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,4243493152850792395,13072507173845886634,2097152 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,11351186756764620542,4583167236774803150,2097152 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,13753295623119131820,18011735357266069006,2097152 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4380 /prefetch:92⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5428,i,4602161017209621024,12720785324996473541,524288 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:142⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,8183229900881126276,16718490222828584876,524288 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5712 /prefetch:142⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,8922760556951162339,12527450083382612099,524288 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:142⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,6688034098316278021,2463802111279954843,524288 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:142⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=744,i,17755039916495740346,4269010550425189289,262144 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,900694549782627561,13964127521401578702,524288 --field-trial-handle=1960,i,14922257685547073080,7486795183295969920,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5008 /prefetch:142⤵PID:780
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:796
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e5db26dbdc07711d94c8252f2b8822de9d3960984183ec0f35039dbb16497f0e
- MD5 c912cfc59057b722902b126693e34ff9
- SHA1 9c760091141507f95702e39987976ef48e0f8aa1
- SHA512 e5ed8b95ca9c8c1fae35b7294615f7f544c4d0e8521bc606466a7380f644d2e31cf07534d49d7294d072fff73b21c0f01ce03ba69d37e1e3f229ece1e6f1cb33
- TLSH T1F7E02BAAC831DCB708FD071870544645E714039B3F90954F3A3C46098FB463656D5D1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 6d166e6fcb75dcf46bc7c13d02c1f553b0c7d0b639bf57e10db6a6f360102ba5
- MD5 d3b88bab5b9ab294f107a47d23d723ce
- SHA1 4e66ddab686b1ed1aedc3a2e9c47fc0fab43ddf2
- SHA512 9e7b4e1e1db1e7638f86a5fc2766a2a9f612766a519347bb2d19b2fdd6cfeb467ecf9681acd9c24eaaa75706e80aeff840da1f455367a793befb1b91f1c4150b
- TLSH T1D941B0F793B4857E860196F4EB156F1FCE690524132C3CA688D4AE1B93F2972E14078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 ad697c4bfa41eba13a2358938fa36f8869d1e7fb06aca64977f324e847d78d2d
- MD5 47e8d286ada2cd4ac55fb26071207f6a
- SHA1 049559ef559b1db59af78275e2ed63310e6e3c1a
- SHA512 93ae6db27aa629d7343530e791f2507ffcf25fe53722815d8628d9406028bbf88afb416d3204705b5f04ec0b8eaa5f12b814ee48aff874f5dd26f24015cd1bff
- TLSH T188419DF793B4857E861192F4EA156F1FCE690524131C3CA688D4AE1B43F2872E10478F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 b2581cdc312f2afa610b1832d9a0052dc728fc1a91b95f4404d3843227d708fb
- MD5 1fcf7893dc12f55b5982043a7b0c7006
- SHA1 412be428d18af0882213e505b30ecbf8bfcf48bc
- SHA512 5f9f80f9dcbd7fe0861b6e102fc0bae328bee8e76f15e105dd30459358a5e8ff8ec327ada36c35606ab4597d8eecf2716e7466d35038bec13c169455ff019d80
- TLSH T13241ADF793F4857E8A1196F4EA156E1FCE690524132C3CA688D4AE2B43F2972E10078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 41a2ec8a15bb2e5d745aa73e40e09f6785c696c7fa90f50efc4d2f4acfb4a39f
- MD5 3049e62e8bca83b2f5691e3ea6575ce1
- SHA1 fca4dee4cebbe7953efc6f71fe0292c5e54b74b1
- SHA512 6152472a9bb9e0c8a7e414586e0819df0991c5fa244d0fafd7dc453da18275df1802942ad7f218ceff2dbc445bf608aac893267c98cbadbdd1421e163bc0b88e
- SSDEEP 192:RRo3vGrlidVv7H+pHPRpHrl9WHsb+WNnb1PE4KHkwpyVyIsnAUgE:RRof/li1XpUw5PJiJyE
- TLSH T17A52E82FF950653B9CDAD729FA11BB53E3F5106171A11E84E6FC8A2C14E76CC222742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
- MD5 a6b03dd39d632b77a2b691136935ce1e
- SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
- SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
- SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
- TLSH T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 24cfd7b3bbfda9df2a7cee78ec536afd9f9ba39cf88960b9253657ee1e2ff031
- MD5 36f62d37752169b1f247b00756a7dbe7
- SHA1 1cf081bf450d16201c79e57e719d000e5558efdd
- SHA512 2777477ca5aff7863e7649921468368fc055f7429a43a2f5fa344565aa211f4c21f46ef565a7673f24d84e989d67991e41f3aca66cc18d111385bc1895ab1580
- TLSH T1E9B01250C4055102C04303F4554258987114DF11EE0F170193E06D6288251508018450
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b532.TMP
- Size 96B
- SHA256 2a40868fdc54d106494a05eef2bb3bf6f45137b066895d56a0348d0a0242097e
- MD5 9d775b2caac574c00f24ea89570559e1
- SHA1 461da19fefc15310e819ceb2bb6a3e1edd9c39d1
- SHA512 0c1bf96f4f9b37ee4113748ee9df1d9fdaf47c3e32d087ddcd3b7af6bb987964f30f37cf6189e086e4fae2cb8460d84e0c248cbc27069687aecdf6f988976377
- TLSH T146B02280C0023202C08203B028C0E0E83030FF20CA03022A83E00F2ACC2023082BCA20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c8882082-c4f8-416b-88db-fc69ebc98558.tmp
- Size 12KB
- SHA256 141070811517fc0a07c71fe3595da82ed0250bc67e6dbe02eeb98026c5e7c3af
- MD5 c0ccab60d80c2ce4cf7957a56d7480c7
- SHA1 c67df34d49c0f3f74266ead811b0ca200dac094d
- SHA512 aa91b7131489cf91d81c5b5d173f6192fd73cf58b56a95bb15235a97a4e4c2dcfabf32c19afd5a2601aca0b3b82471ae5aa0a43dd6983480b4805041882771c3
- SSDEEP 192:RRo3vtrlidVv7H+pAPRp2rl9WHsb+WNnb1Pkh4KHkwByVyIsnAUge:RRofyliUX6Uw5Pk6ihye
- TLSH T1CC42C62FE950A53B8CDAD72AFA217753E7F5106171A11E84E6FC8A2C14D75CC222742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 079c10cdcb56bf7f013d73353ac6e7d83576f36f1c32545305b4cdeeab817c6a
- MD5 213ce3446b5d8a3799152dd88f50ff4c
- SHA1 4103c50de298413126732f1544c809c7e7bd01d1
- SHA512 d8e3dec259125b077bf7bb280e3db8a2519bf3d8308cf8717259897bebfb975fc4be90052235254bf607fc557d4bd640234a0c31e8294571f547a58d87acc3d7
- SSDEEP 3072:Ey1zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:EEWDfxA3OnjrYQ9EU0/hEV
- TLSH T16CC302A15C3ABC660DF8EE98640D3E60BFF46C9A91876DD3A2ED1F4C14FA5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 d95ecaadc1212a8d4e24936351e33872d49e9db21375773db08af26ebb1e1c18
- MD5 10ec8d555201e41c01b2bafc8c45bdb6
- SHA1 1f5a382d5e62449af276079017735de94db436b7
- SHA512 a3a48ff1d4199b61e68e50958955b8284583843fcdda3ea7bd96b133425d76168c9399505179eea6befe9f9f6f96672a1ff6052abca0537e452c78ea9d15c45e
- SSDEEP 3072:0y1zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:0EWDfxA3OnjrYQ9EU0/hEV
- TLSH T167C302A15C3ABC660DF8EE98640D3E60BFF46C9A91476DD3A2ED1F4C14FA5C8117A930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 edf553a0abb4c96759944a9cc0ec6b47605a8cf3f3e6d6df2d278638989a0e0e
- MD5 15d4a7e4aa99628fb884ea62d5eae4af
- SHA1 8d1c2d2088293838a8ef023d583f41de2b476e56
- SHA512 d64105a2e0aeb0865038dade6ea333745be66bffd3a7f8d8fa8b503ea57c8761a1cebda2e44a44f0d16c595f96beac9ae04d10293c63ad316e7c21b327743764
- SSDEEP 3072:7zWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:/WDfxA3OnjrYQ9EU0/hEV
- TLSH T16EC302A15C36BD660DF8EE98B44D3A60BFF4AD9A91835DC362ED2F0C14FA5C81139970
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 cf8586bd71a1019dd40fba94986afcc043c2cd45b4de652d0330c240b749409f
- MD5 8ceb863c3ea227af7ddb723fceaf0db0
- SHA1 63cd08a7e8c225eb6f7f430d2dea3001d79f0a05
- SHA512 23c581664f3e1ba47ce985b86a9f20549d71787e1a674f2ce4fae326eff31b3f249caadc1be3da51f01e29bfb6ae4af2316181d60772af431a92bee6e91f6a1b
- SSDEEP 3072:ZPzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:NWDfxA3OnjrYQ9EU0/hEV
- TLSH T1D5C302A15C39BD660DF8EE98740D3A60BFF4AC9A92875DC3A2E91F4C14FB5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bc42cddb-6539-4422-9e88-9bb9d33294b9.tmp
- Size 116KB
- SHA256 6d8ee5ec1527635d11b5c0da6cb406004567da9a7bb0d8f54ae6a7e2d202272e
- MD5 211b904cf8933c4709a82d28c2ee15ca
- SHA1 34c910df81091e28c52e6aef0c836d4d13683bff
- SHA512 bb8ee438caee1c433682406555cba4645ea0622d2580c751089a84bfaef9f4dfa8bacd60b216e9983d9edbeedded4f327a505a6f5ee36a0012116043a7f3132d
- SSDEEP 3072:SPzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:WWDfxA3OnjrYQ9EU0/hEV
- TLSH T154C302A15C39BD660DF8EE98740D3A60BFF4AC9A92875DC3A2E91F4C14FB5C81139930
- MD5 SHA1 SHA512 SSDEEP TLSH