Overview
overview
7Static
static
3Silent Cli...64.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
1LICENSE.electron.txt
windows11-21h2-x64
3chrome_100...nt.pak
windows11-21h2-x64
3chrome_200...nt.pak
windows11-21h2-x64
3icudtl.dat
windows11-21h2-x64
3locales/af.pak
windows11-21h2-x64
3locales/am.pak
windows11-21h2-x64
3locales/ar.pak
windows11-21h2-x64
3locales/bg.pak
windows11-21h2-x64
3locales/bn.pak
windows11-21h2-x64
3locales/ca.pak
windows11-21h2-x64
3resources/...er.dll
windows11-21h2-x64
1resources/...on.svg
windows11-21h2-x64
3resources/...go.svg
windows11-21h2-x64
3resources/...go.svg
windows11-21h2-x64
3resources/...r.html
windows11-21h2-x64
3resources/...ter.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...nt.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
606s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/07/2026, 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Silent Client Setup 4.4.2 x64.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
600 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
LICENSE.electron.txt
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral8
Sample
chrome_100_percent.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral9
Sample
chrome_200_percent.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral10
Sample
icudtl.dat
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral11
Sample
locales/af.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
locales/am.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral13
Sample
locales/ar.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral14
Sample
locales/bg.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral15
Sample
locales/bn.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral16
Sample
locales/ca.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
resources/assets/icon.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral19
Sample
resources/assets/images/full_logo.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral20
Sample
resources/assets/images/logo.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral21
Sample
resources/assets/updater/updater.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral22
Sample
resources/assets/updater/updater.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral28
Sample
$R0/Uninstall Silent Client.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
600 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target resources/assets/images/logo.svg
- Size 86KB
- Sample260723-2vr5dade59
- SHA256 ad1d859b9f2f5b7dcecd6b199a96b6bb164655b33b9545506f1479c94899fcfd
- MD5 d22bf1aee0486d9ce98e69e9507fd357
- SHA1 62b828b051b4773185d0414905574e9b8b17d235
- SHA512 dfae09b7871f26e0aeb12799dd60ff79e61b590d8e3537caa3aa2a898f75788465a9780360ca4fbfba192d1f76ffff766d3113ccca610b5ef967b5420cae13e3
- SSDEEP 1536:yxzVcjBgQybTGNYqJkLbG1uokIOOKr4r85ujR7b7TJVHeyH9qEW5j4Q8T2yeBvzb:yxKjyGgqSOWGR/7TPeyH04AyeJzb
- TLSH T1D593F1B6565874CE29989E3EF23C2A44AC35613756D062CDFFC11102B0F8D0DF6AE796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2732 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293210864253188" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 4156 chrome.exe 4156 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe Token: SeShutdownPrivilege 752 chrome.exe Token: SeCreatePagefilePrivilege 752 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe 752 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 752 wrote to memory of 5136 752 chrome.exe 79 PID 752 wrote to memory of 4564 752 chrome.exe 80 PID 752 wrote to memory of 4564 752 chrome.exe 80 PID 752 wrote to memory of 2732 752 chrome.exe 81 PID 752 wrote to memory of 2744 752 chrome.exe 84 PID 752 wrote to memory of 2744 752 chrome.exe 84 PID 752 wrote to memory of 3280 752 chrome.exe 85 PID 752 wrote to memory of 3280 752 chrome.exe 85 PID 752 wrote to memory of 4968 752 chrome.exe 86 PID 752 wrote to memory of 4968 752 chrome.exe 86 PID 752 wrote to memory of 1700 752 chrome.exe 87 PID 752 wrote to memory of 1700 752 chrome.exe 87 PID 752 wrote to memory of 2456 752 chrome.exe 88 PID 752 wrote to memory of 5312 752 chrome.exe 90 PID 752 wrote to memory of 5236 752 chrome.exe 91 PID 752 wrote to memory of 5380 752 chrome.exe 92 PID 752 wrote to memory of 4156 752 chrome.exe 93 PID 752 wrote to memory of 5688 752 chrome.exe 94 PID 752 wrote to memory of 5688 752 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\assets\images\logo.svg1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbd71c728,0x7ffcbd71c734,0x7ffcbd71c7402⤵PID:5136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,14687354925430039364,1686825513897868828,262144 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:22⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,9957007591922284582,8892791138850928792,524288 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:112⤵
- System Time Discovery
PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,10509655740331267022,5217396437055763988,524288 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:132⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,13099431511066839260,5689060343444045647,2097152 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,5974494280651605328,133702926508517323,2097152 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4308,i,17987384445599183006,1947052956720319583,2097152 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:92⤵PID:1700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,4280328785909319403,10501472230065647806,524288 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:142⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,9322438514658039908,4214751477219706986,524288 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5256 /prefetch:142⤵PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,15245696290205619864,18222755831618863185,524288 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:142⤵PID:5236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,9847574674310969313,2118399713106037307,524288 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5640 /prefetch:142⤵PID:5380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5520,i,6844680885972990706,10716705368313219089,262144 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4272 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,563613043407246876,17491921885294831262,524288 --field-trial-handle=1976,i,999844980773772432,5889672328455873174,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:142⤵PID:5688
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2496
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 eb200610222fc706e2c23385c7926c8b8372860b4b931e328911ce0f99fb120c
- MD5 5a13509c90efa5d81086daf563782bf7
- SHA1 7975d51fe3bea3b1e4caef00204686172be61b18
- SHA512 bb991669175116d067e60cd62eb887dbd5c938cdc640d4fb3c3e69c0b291ae2dfbb82368047a84f06bc1cbfd5ee1c082fe465fec93542b6a79e356b1cc792a22
- TLSH T15BE0ABBEC850DC2B2CFD074960244601D20103033740594F363D920CCFB1A3B4691C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 7c447be32e2ee00fc56ff65a0a6390edc4a3c74de136e80de0d7aa0709d589e6
- MD5 ba657038e49f726ffbcbe110382f57f8
- SHA1 8497ef4a29913c1f4b7c82be37f169cb60a9c1e6
- SHA512 fda2dc4b3b3323708925958a1c4474ffb748f06b8cdc2ac87956463a90d76edaa98f8a255cde24384fdb7e968ce5b62d01905927a95de03d51419c5c224e941d
- TLSH T120419DF793B4897E8A1192E4EB156E1FCE690624131C3CA688D4AE1B53F2972D10578F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 95a98640d945297aee86c62e4458918d2d008883545348aab89ca661b2059a46
- MD5 f0f98af3b0107444f0dc53a30336ace5
- SHA1 2f4c3ee00764e6567c8513f1031f5146ccec6590
- SHA512 6ebd8b581ef5e571ff05151954cb55218ee033a37a740acd6c814b031288d52d7f52a16ba17325d3245b20fa61788073b181fca7e592f607307dda3b88b7d27d
- TLSH T16741AFF793B4897D861092F4EB156F1FCE690624131C7CA688D46E1B83F2972D10178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d1a2c837d38c8d56f15cab7059382a138615d067ba26dae13c105be4403d14f4
- MD5 2d6263b97d197fb8b01672c71ee5e5ae
- SHA1 cb8cdd77843c249c674a3c512f93705e555a9e4f
- SHA512 cbcf33f3f76019b7bdd676b54ed211bc3e9f6230479359c33208ac5514b2a47eb6dc1f8c04c4dd7f887848ab282e7cc3b2091df97eb7edc9e5478af3abbd50c1
- TLSH T14241BEF7C3B4857D8A1196F4EB156E1FCE690924132C7CA688D4AE2B93F2972D14078E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f351e0dc17fa79c973d83ec623474ff4541b84ec9e55ee31f29cd96af3be3ae9
- MD5 cdf98159100242ad693e3c9831776053
- SHA1 3595ba75c2f334a67ee176df7ceab0e7082f2172
- SHA512 e656c62ef9a726325b23819c4892e089fc42d40b9bc33cb79ddd869e0806a9307020078a02e963231099261575eb8d8c7717f618555bb5ca4c790b2ef36e1aec
- SSDEEP 192:qRKRtjA0nwSo/v7lpAPRp2cW9+Hsb+WNnZhPqC2jyHukwEaoVyIsnAUge:qRKRXnMXRUX00wvPN2jyOkaMe
- TLSH T1E742D77EED50A87B6CDBC21AFB297753D7F9102122952E84EAFC891C14D79CC222705B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 57cef669724b10d41371d8ca82176cb51bf86c9907f76092ff7a2d1a0f4412ed
- MD5 191f63ab8a69fc82cd8d39331cdb6ec5
- SHA1 4d6d5c3274c6b47012477857c143bb14af1c1c81
- SHA512 2a7cc2a8bc89fc8a02f3c0916259ec6581be2acfe88501d7f57152bd4bf79e09c16d240536abffe053d78cbcbaa8d9215ffe75c647ac61b492c5ad1960746896
- SSDEEP 192:qRKRsjA0nwSo/v7lpoPRpecW9+Hsb+WNnZhPhC2jyHukwEaCVyIsnAUgE:qRKR6nMXRcXc0wvPA2jyOkaCE
- TLSH T15452F97EED50687B6CDBD219FB297B53D7F8102122942E84EAFC8A1C14E79CC221705B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
- MD5 9365e110646fce4577746230e9396c69
- SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
- SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
- SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
- TLSH T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 9b278192a4b7615d208bb4424c0ae044712a7700ccc7cb64c0cd588ae7f23b4d
- MD5 8cb06f0b03873e2073b6c9c20bf6c3b3
- SHA1 e0e5593cc52d46c08c173f2ac49a79358a570846
- SHA512 6877ca383846a0dcd7d8de6ebf1e2f048d34619816e8c6384f206eca34aa9554e6758b2baa740b7a1290a7156322852cf806d6615342a30f175dce26cdb9ee02
- TLSH T1F3B01240C0025501C04202F81EAA59987118EF629A0F170143E06923882926085280D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58deb3.TMP
- Size 96B
- SHA256 6d3c50cda8d8367f7aae9d44c6966cfa6c1fc12ed0df1bf409e14fd19ebe2abe
- MD5 e6281aa6f35effdc448f6603fd6a34de
- SHA1 b8358c3ef62b6f40e6117f7c400af486824b137a
- SHA512 968dba68de868b6a1dda6dd0b8e803ba6e8a1b49d51a2ff87181198c1955c8137911f07bf0ed944fd7b091caf40c7bca025a6e336738fc9567d70cdfa7d20a60
- TLSH T135B02202C2022202C00303F03FC0C3E8B8A0EF2CCE03020382E00BA3CC30A300028820
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 fbbb410eecc2681b1ef3553d1b1dc3dcad06e97ba9308e1a88746444120969da
- MD5 a4cc022c6327ee8020002b9b8e2ca80c
- SHA1 6d8f6a763db6f35d49fd5299e66767bf57795eba
- SHA512 84592a0b0a4625600085296cd2b34affb2acd79d1f2f80652390831794f891d0d096688177b167d802ea63be8961fe0a0b62a0ed944fbad4c5c7b6073c3e2c98
- SSDEEP 3072:OGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Jm7Rkm1tYpBeh2BAoa
- TLSH T17BC3123B5D74E9375DB9B75EB08E0B1F1EF149A3C920DE92C8D85B0423EA6CD1A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d77dabeb50cecc6c3fb322b8c27eb977fad33fbdc815697bf7a8fa4f1066187a
- MD5 3603402c2836e1ee5616c8f1b8aabcfa
- SHA1 d60ca31146ffc3a367dfa5b71a8cb736282bbba1
- SHA512 975f8e41325cd584434116977ea350816335c38f5773484f72e07a3301db4b76d155b24347b7aa3f60c68d5a2d876a007c05b9a754f3511856ca749345c2136f
- SSDEEP 3072:WFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:WMm7Rkm1tYpBeh2BAoa
- TLSH T16BC3123B9D74A83B5DB9BB4EB04E0B1F1DF149A7DD20EE52C8D85E0423E5ACC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 be46e87c293edccc23adb7f3223f68e8b5510bdc9cfdea8057a16e3416542ee1
- MD5 b9d1c4331dcb3ecb335a560832fad9e8
- SHA1 329aac5662df5ecdfcc320071d3f31b3bd8cbd1c
- SHA512 f0a962ebd7634fb33f944487d888c7daf64b5aaf8200db18baecdf5671250f4e275d6630b2a68e9a17e1b93bf31351fe4899cfe51057549ed4963f205daac799
- SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:im7Rkm1tYpBeh2BAoa
- TLSH T1F9C3123B5D74E9375DB9B75EB08E0B1F1EF149A3C920DE92C8D85B0423EA6CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 de3904a554001a5e7c5b07f6aba890488a17ac3f35b61bbc9478c25f747bb906
- MD5 162a27f09f303a20083dcd4f811eaafb
- SHA1 551284148227f486e94eec15a37b4a5c2d8ac835
- SHA512 59535ea5f3a328d711af6e975c853d0838fa8e8308a0ac02dde5dbc624be3adf46d9ef597436e2e1ffbc28dd9838727e45d41a8667a9ae51f804646ccf5fb6db
- SSDEEP 3072:SFGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:SMm7Rkm1tYpBeh2BAoa
- TLSH T193C3123B9D74A83B5DB9BB4EB08E0B1F1DF149A7DD24EE52C8D85E0423E56CC0A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 86b457bd49cc5fe2ff6e1ef07e95ffa5ae8f97862a054b50c779d5124ad754ed
- MD5 af4873d5f2ce54077e9b1c5be38c09be
- SHA1 f2f5a10733e7f5c9344f609256a58d0632c35a78
- SHA512 fed8f1a592cae5f5d723ee1ab964c730c841fdcac9447cd394afc4dc804a16c6f9de01e0cf077e942ef8e7e6ec609973f9ba01231377a3cb76bf002a8af279ab
- SSDEEP 3072:dGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:0m7Rkm1tYpBeh2BAoa
- TLSH T11BC3123B9E71A9775979BB4EB08E0B1E1EF149A3D920DE42C8D85B0437F97CD0A05934
- MD5 SHA1 SHA512 SSDEEP TLSH