Overview
overview
7Static
static
3Silent Cli...64.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
1LICENSE.electron.txt
windows11-21h2-x64
3chrome_100...nt.pak
windows11-21h2-x64
3chrome_200...nt.pak
windows11-21h2-x64
3icudtl.dat
windows11-21h2-x64
3locales/af.pak
windows11-21h2-x64
3locales/am.pak
windows11-21h2-x64
3locales/ar.pak
windows11-21h2-x64
3locales/bg.pak
windows11-21h2-x64
3locales/bn.pak
windows11-21h2-x64
3locales/ca.pak
windows11-21h2-x64
3resources/...er.dll
windows11-21h2-x64
1resources/...on.svg
windows11-21h2-x64
3resources/...go.svg
windows11-21h2-x64
3resources/...go.svg
windows11-21h2-x64
3resources/...r.html
windows11-21h2-x64
3resources/...ter.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...nt.exe
windows11-21h2-x64
7$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
599s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/07/2026, 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Silent Client Setup 4.4.2 x64.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
600 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral7
Sample
LICENSE.electron.txt
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
600 seconds
Behavioral task
behavioral8
Sample
chrome_100_percent.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral9
Sample
chrome_200_percent.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral10
Sample
icudtl.dat
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral11
Sample
locales/af.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
locales/am.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral13
Sample
locales/ar.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral14
Sample
locales/bg.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral15
Sample
locales/bn.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral16
Sample
locales/ca.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
600 seconds
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
resources/assets/icon.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral19
Sample
resources/assets/images/full_logo.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral20
Sample
resources/assets/images/logo.svg
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral21
Sample
resources/assets/updater/updater.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral22
Sample
resources/assets/updater/updater.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral25
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral28
Sample
$R0/Uninstall Silent Client.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
600 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
General
- Target resources/assets/updater/updater.html
- Size 423B
- Sample260723-2vr5dade59
- SHA256 6ab2c4f63e9c6fb6b29315b9a0909f0977d935e61027603dc4773f1f673848ab
- MD5 80ca9f9545a5cb816ec202c5ac7cc6d8
- SHA1 383035241b86667aa8cc192d675706974e89eeef
- SHA512 a78d8c9ae1cc2e40a113c1843bb03efe7a09ab1125338681a580bf2457efa582a3c4c72c61b3a3e06849d9fe200a2005648ac8276533f583abf7fe03eb8a786a
- TLSH T153E0682E89AD8472D8E1119EACD1B7E93DE5D509C78F902030E4A948DF6AE81CC4F426
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4228 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293210845301283" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3164 chrome.exe 3164 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3264 wrote to memory of 3112 3264 chrome.exe 79 PID 3264 wrote to memory of 3552 3264 chrome.exe 80 PID 3264 wrote to memory of 3552 3264 chrome.exe 80 PID 3264 wrote to memory of 4228 3264 chrome.exe 81 PID 3264 wrote to memory of 4988 3264 chrome.exe 84 PID 3264 wrote to memory of 4988 3264 chrome.exe 84 PID 3264 wrote to memory of 5912 3264 chrome.exe 85 PID 3264 wrote to memory of 3432 3264 chrome.exe 86 PID 3264 wrote to memory of 5912 3264 chrome.exe 85 PID 3264 wrote to memory of 3432 3264 chrome.exe 86 PID 3264 wrote to memory of 3400 3264 chrome.exe 87 PID 3264 wrote to memory of 3400 3264 chrome.exe 87 PID 3264 wrote to memory of 5796 3264 chrome.exe 88 PID 3264 wrote to memory of 1288 3264 chrome.exe 90 PID 3264 wrote to memory of 1612 3264 chrome.exe 91 PID 3264 wrote to memory of 3864 3264 chrome.exe 92 PID 3264 wrote to memory of 3164 3264 chrome.exe 93 PID 3264 wrote to memory of 1524 3264 chrome.exe 94 PID 3264 wrote to memory of 1524 3264 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\assets\updater\updater.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabaaac728,0x7ffabaaac734,0x7ffabaaac7402⤵PID:3112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,13254705759102243804,2190790399398659574,262144 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:22⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,15553277769153804779,3926429143537025276,524288 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2220 /prefetch:112⤵
- System Time Discovery
PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,2146184214674828518,789547378840483520,524288 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:132⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,10768464849679663328,13241236054071493720,2097152 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:5912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,1204589106297563387,15920604765140009202,2097152 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,18076992543199117028,2095308590002476107,2097152 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4360 /prefetch:92⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,10445370858121207666,8532760968876224467,524288 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5372 /prefetch:142⤵PID:5796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,2247831724753660454,17743523993238562353,524288 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5380 /prefetch:142⤵PID:1288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,910330751480474479,4850115296704106602,524288 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5404 /prefetch:142⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,8600694722343962160,7483932161043998702,524288 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:142⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5548,i,8269849467967291316,1999659166098883886,262144 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5228 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,16596429547201107196,7430117370496501467,524288 --field-trial-handle=1980,i,12857048981820393629,14181516020032307024,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1516 /prefetch:142⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4616
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 bb9e10e9a226402d7c393501752c4bbf85c1f934e65f2b553b69133ed6f070c9
- MD5 879aa537ed3749817dbcb5427b90bb1e
- SHA1 4c5677927b14e7f0374389fedd9cdc37c45c561a
- SHA512 acfee8ea88c742833fc11cc1e32d5f9e492ca348c9d4ab3126bd1e26ce09adba6f001220aad08ee558d825f7cf39fd78d4ee0a41741a43fcf7172ace461752df
- TLSH T1C8E02BBAC8619C2B1DFD1B6C71555349EA6013572B806D0B3B3C810D8FB1A3A524585C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 f81e841762ce6ed5630b6191b6166e0b2f19caeb0a8bd9abba78fa6a7791cc78
- MD5 b8ec838ecfd7d50b122a4bd74115c725
- SHA1 1d036f423843abeb80232067efe77607ae02758a
- SHA512 c3dc79d0cd52c605e7277b5ff0c830c291e31b592c7068a33e1bc1ab22a0d688593bb87c6de021831f6bca5d6c9f054bcbf8cfb81f384f1dcfe185f18c625de3
- TLSH T10A41A0F787F4897D861196F4EB156E2FCE690524132C3CA688E4AE1B93F2871D20078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 214ff2b2c487b515a5ac5af6066364b4c496d34f16ee02b5ab0d289c1d977bbd
- MD5 5bc72cb5b82e11b3151ecce2191e54a8
- SHA1 3816e788fe7b1a19813f00b208ded0d3daee154f
- SHA512 051e29110fbb1a7713d483c227c8b1b0a9d5487f19071c5612d6db6366ea24d2dcd8cc35a723aa03ad63297c3d48f51f663bbacd759aefc032043e52d598876c
- TLSH T1C941A0F783F4857D861196F4EB156E2FCE690514132C3CA688E46E1B93F2871D24069F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 3efbae308dfe01fffb71b483200ecfa363fd73133a061367e8bde356a2b2d8e3
- MD5 400c51b2e5eb8adb55fba49e5df825dd
- SHA1 44b0b2f1ce05e1e415f00a14599de9548d21acc0
- SHA512 94cd9e2de419f488cdda8c2e603a65bf30f306f5d29da00709311e949bb1b943190328f13c08a45ade4963c0d58fde08dc785b7a499be402fc3b6d8e690d7ffa
- TLSH T14B419EF783F4857D861192E4EB156E2FCE690614131C3CA688E46E1B93F2872D20075F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9af5d7034b8d5acf6718979a49fbf5e72253cb09acfe7f46f31364f6dd0e249f
- MD5 2ae6b1d60fa452d970cb5dc66efc7a0c
- SHA1 3688aec343d949149266798bd59dc8ad591932c8
- SHA512 903ebcdb54c1f0dae2130f40a69aaeeed33da00819d2e8ec406f74863c3b82146101847f8d5f08793dc08e34ec55e9c79704b29fc264a3b28c6e0ec5cad568c1
- SSDEEP 192:sR5NvtJQTucoq/A5v7HpAPRp2IS9DHsb+WNnFuP3k2kkQePQVyIsnAUge:sR5NvQTucoVZjUXA5wsPU2kk1Ue
- TLSH T18542D83EEA50693B6CCBD269FA657B53E7F5102121D02E84E6FC892C15DB9CC221700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 a2a6a2f5a72e8d9940d187ccc364aebaea8af82f7e62202511505985b85a3843
- MD5 d875bb6ea9166109a6e53dc6a6b00a91
- SHA1 66982f4b3961af0b9be601df16de3c09c28a2be8
- SHA512 9c229ead20fed70b2f49e64c30749f9da15d69b21cce2cf79fbab56d0a6793017811f0a084e5cbfe82af1a0d984fef8ef71d8551ca857f97ea2bc47ddf50cd52
- SSDEEP 192:sR5NvxJQTucoq/A5v7Hp8PRpuIS9DHsb+WNnFuPyk2kkQeP8VyIsnAUgE:sR5N7QTucoVZjwX45wsPr2kk1YE
- TLSH T1B552EA2EE950693B6CCBD269FA657B53E7F5103121E02E84E6FC892C15DBACC221700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
- MD5 a9125c26694a66613be5174b13bd716c
- SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
- SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
- SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
- TLSH T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 1d0250f55dac918b3febe40737c81f87b1a0318673f93affa8a572e2d7073102
- MD5 5ff633bab7b703c9721c018ff48f37d7
- SHA1 fc383949bff513bb99d9ad3c0410b86b8e612d43
- SHA512 c58028dee8e207374ac314b84cf0fcfb3d61af2b968dd524da811bce81e3795a391a28113f05f096fe1d63321bbbabf323b1d253739f0fa1ec2215d22c8881bf
- TLSH T1D7B0124080015101D04302F4214794987124DF10DA0B270153F07A638C2D951C41C090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59048a.TMP
- Size 96B
- SHA256 c2c2dcc0f1f5ed9ca931f297b768df5e5b967790f60355a5a7144f7990d57bdb
- MD5 e2d29ecf459b51804ee149309c0f5086
- SHA1 1d22ec1422796b5eba7fb4cc229507abbec547f5
- SHA512 c00a0186206812233c43686d130959f6a382a98827ff9281880a38791c7af349e801bd398616a050d76d6f877a8c2b496374934f955b2b295efc0d9228fe4b64
- TLSH T121B002B5C6037212D05713B13995DDF8F162DF65CB03221792EC1A66DC257644929964
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 9c870fe35faadc98e32418d6b3492cf5f50939cf01a2077d7a2f9b45d2be7a64
- MD5 250d6b9aafc14f330829056c996414b2
- SHA1 3c57584dd046d3d3ebe218148a142dbf641c68e0
- SHA512 527b0056b70c7d5326d694c537864eff6e44ca28cad298d476f37b17f55d8626333d30c4cea322221e003970bea5008b9ad214528b07099125d93c733182d964
- SSDEEP 3072:TnGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:TGm7Rkm1tYpBeh2BAo+
- TLSH T1BCC3123B9D65A93B5CB5B74EB04E0A1F1EF149A7D934EE52C8D85E0423FA6CC0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 a71f0cfc8e6913ca482568bc090fef482c6bf63d76511fdfd8dcfc00b2650c1c
- MD5 0aad366f1c73541cc7e4c5d7659cb252
- SHA1 6add2181cdf30ccbffbdd073fe5befaf2b60cb8d
- SHA512 55ee6249070471266ee9c0b422eafd2ac3752ff954510dd44b0705e40307b636770cab913b5d1851d7156c1f5343d26e1fbacf8c224198c0457314d5b599cd4e
- SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:4m7Rkm1tYpBeh2BAo+
- TLSH T164C3123B5D75A87A58B9BB1EB04E0B1F1EF149A7C930DE92C8D85B0423FA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 812ffa2f655237e0ad5bb6fae3ff8e146bd8bea2670b2f605184d2d9b3f3a081
- MD5 c62c84503b136a93f91047a48cff4b0e
- SHA1 1cd179a2a2faf157bff1db2ca75283f51aa62515
- SHA512 92d98484a629895a296cf93b58f444fa645916d2c10a223bd79939763e245abe74402a03fc0ee10a49939fd007ae10650b5239df838aed58c658378e74135982
- SSDEEP 3072:IGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:jm7Rkm1tYpBeh2BAo+
- TLSH T142C3123B5D75A87A58B9BB1EB04E0B1F1EF149A7C930DE92C8D85B0423FA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 4648ebc1a2a26882f3125f1bd1f353b1fbfb00bec7249deb452c1191e62ad99a
- MD5 c87c6f051c490714e892853f9eb79678
- SHA1 287d81b51f7c214888ceadf7123d1920a02c812c
- SHA512 b45af800a9614a244f486c4d9e6cbb584b8bba170f4881d241c48187b7d975704c1fb214a58d6c1e477442541abd1ebb39f57e57e70e8a06065db2797d71e127
- SSDEEP 3072:/nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:/Gm7Rkm1tYpBeh2BAo+
- TLSH T175C3123B5D75A93A5CB5B74EB04E0A1F1DF149A7D934EE52C8D85E0423FA6CC0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 d18f70e3be593f975d9e9d36a2e01303db47a49b3da3cb0ae73602d166062bab
- MD5 aa768cd6eeca3cc9e092b48ccd36a428
- SHA1 e66287488996b1234edd883c6c865b4c6dcee81e
- SHA512 5ff9a1d8fe5a9197655742b562d088f2be9236fa7c2ff425d759faf5b075ada283e773546262da81448c098cbfd432b59a83cd1d05cc3679f6376de78344f908
- SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:4m7Rkm1tYpBeh2BAo+
- TLSH T131C3123B5D71A97658B9B74EB08D0B1F1EF149A6C930DE82C8D85B0477FA7CC1A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH