Overview
overview
5Static
static
3Potassium....pet.js
windows11-21h2-x64
3WebView2Loader.dll
windows11-21h2-x64
1autoexec.lnk
windows11-21h2-x64
3bin/Decompiler.exe
windows11-21h2-x64
1bin/Potassium.dll
windows11-21h2-x64
1bin/Potassium.exe
windows11-21h2-x64
5bin/monaco/index.html
windows11-21h2-x64
3bin/monaco...ain.js
windows11-21h2-x64
3bin/monaco...tes.js
windows11-21h2-x64
3bin/monaco...ase.js
windows11-21h2-x64
3bin/monaco...ses.js
windows11-21h2-x64
3bin/monaco...del.js
windows11-21h2-x64
3bin/monaco...num.js
windows11-21h2-x64
3bin/monaco...tem.js
windows11-21h2-x64
3bin/monaco...ums.js
windows11-21h2-x64
3bin/monaco...nce.js
windows11-21h2-x64
3bin/monaco...del.js
windows11-21h2-x64
3bin/monaco...nal.js
windows11-21h2-x64
3bin/monaco...der.js
windows11-21h2-x64
3bin/monaco...ace.js
windows11-21h2-x64
3bin/monaco...-pd.js
windows11-21h2-x64
3bin/monaco...ons.js
windows11-21h2-x64
3bin/monaco...als.js
windows11-21h2-x64
3bin/monaco...rds.js
windows11-21h2-x64
3bin/monaco...ing.js
windows11-21h2-x64
3bin/monaco...ypt.js
windows11-21h2-x64
3bin/monaco...bug.js
windows11-21h2-x64
3bin/monaco...ath.js
windows11-21h2-x64
3bin/monaco.../os.js
windows11-21h2-x64
3bin/monaco...oth.js
windows11-21h2-x64
3bin/monaco...net.js
windows11-21h2-x64
3bin/monaco...gex.js
windows11-21h2-x64
3Analysis
- max time kernel
599s - max time network
598s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/07/2026, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Potassium.exe.WebView2/EBWebView/Subresource Filter/Unindexed Rules/10.34.0.84/adblock_snippet.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral2
Sample
WebView2Loader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral3
Sample
autoexec.lnk
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
bin/Decompiler.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
bin/Potassium.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
bin/Potassium.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
600 seconds
Behavioral task
behavioral7
Sample
bin/monaco/index.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
600 seconds
Behavioral task
behavioral8
Sample
bin/monaco/vs/base/worker/workerMain.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral9
Sample
bin/monaco/vs/basic-languages/lua/autocompletes.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral10
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/base.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral11
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral12
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/DataModel.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral13
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enum.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral14
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/EnumItem.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral15
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Enums.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral16
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Instance.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral17
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Model.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral18
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/RBXScriptSignal.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral19
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/ServiceProvider.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral20
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/classes/Workspace.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral21
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/functions-pd.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral22
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/functions.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral23
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/globals.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral24
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/keywords.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral25
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/Drawing.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral26
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/crypt.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral27
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/debug.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral28
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/math.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral29
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/os.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral30
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/oth.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral31
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/raknet.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral32
Sample
bin/monaco/vs/basic-languages/lua/autocompletes/libraries/regex.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
General
- Target bin/monaco/index.html
- Size 18KB
- Sample260729-nyhs8avwhy
- SHA256 589dfdfd1851ef4e64a6f346de8a25d125e9113957fde3c0f7e8ce330da9a63b
- MD5 8fd8d51f3c0c602ce8bb3ce24c759de0
- SHA1 a43d4d108728151cf5a4b4ad505de80c7f5c929c
- SHA512 a0054794d43959617923452d41bdce78caa541e8d2bf633db006a57779d75d80c3912b311521001e1fd05f8b60f589d6b52c776adc5309c7b7ed41b7e305a9c9
- SSDEEP 192:oIJbX0ggAbOmUSMKTnuMuTcJg5v2wzQW3V1VHDwFgBsK4u24FzZ+MHTq58BNLQPS:X0ggAbOmRJd/sV1VjwFgBs9SMwZ
- TLSH T19B8220DAB95F50CE7292326AE0FFF60AEC2DD17EA10506F6F69E6C708949106437342C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 6068 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297993555269014" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 1308 chrome.exe 1308 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe Token: SeShutdownPrivilege 3416 chrome.exe Token: SeCreatePagefilePrivilege 3416 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe 3416 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3416 wrote to memory of 1860 3416 chrome.exe 80 PID 3416 wrote to memory of 6028 3416 chrome.exe 81 PID 3416 wrote to memory of 6028 3416 chrome.exe 81 PID 3416 wrote to memory of 6068 3416 chrome.exe 82 PID 3416 wrote to memory of 5216 3416 chrome.exe 85 PID 3416 wrote to memory of 5216 3416 chrome.exe 85 PID 3416 wrote to memory of 5584 3416 chrome.exe 86 PID 3416 wrote to memory of 3312 3416 chrome.exe 87 PID 3416 wrote to memory of 5584 3416 chrome.exe 86 PID 3416 wrote to memory of 3312 3416 chrome.exe 87 PID 3416 wrote to memory of 3888 3416 chrome.exe 88 PID 3416 wrote to memory of 3888 3416 chrome.exe 88 PID 3416 wrote to memory of 1556 3416 chrome.exe 89 PID 3416 wrote to memory of 1636 3416 chrome.exe 91 PID 3416 wrote to memory of 3896 3416 chrome.exe 92 PID 3416 wrote to memory of 2660 3416 chrome.exe 93 PID 3416 wrote to memory of 1308 3416 chrome.exe 94 PID 3416 wrote to memory of 3204 3416 chrome.exe 95 PID 3416 wrote to memory of 3204 3416 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\bin\monaco\index.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc580ac728,0x7ffc580ac734,0x7ffc580ac7402⤵PID:1860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,6646568753204709993,3834532862466401242,262144 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:22⤵PID:6028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,17448730122110403327,502504931967142416,524288 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:112⤵
- System Time Discovery
PID:6068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,12720698789284073011,15170879584634902986,524288 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1884 /prefetch:132⤵PID:5216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,9200738923796108951,5175272203429043308,2097152 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:5584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,3449953929275071231,11391712953630508718,2097152 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4296,i,7508850643134622643,10540651363495391168,2097152 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:92⤵PID:3888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,13379432112587770504,1654991667016739520,524288 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:142⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,3233266671583907080,11650159060453118318,524288 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:142⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,5844545883575789418,11390012992659106718,524288 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:142⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,14951321700297987394,17577134168154038809,524288 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:142⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5248,i,9380500489953298782,6897732111192023916,262144 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3876,i,11743591649482281530,1125127754634412247,524288 --field-trial-handle=1968,i,1831118373288276142,1878564169954852271,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1064 /prefetch:142⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 d6156a2693039a4bf02e9143ba30565e90c05bb5ac0520e5abbf8244e01438a7
- MD5 1ee66858a3edf4bfa8f1e2510ab20fd3
- SHA1 239a159ddd72e42cf6db879fc8154580f6f4c642
- SHA512 df6d943fb9722889390d3e7ebe075b90e548aa8a56f5b7e8471698fef759dd903ad54e2d3c4a3476c7af78f6586f774626314aeba58c0de10dd9fb0eff4f8cba
- TLSH T13AE02BEECC30DCB714FD0B5860444A4BFB4417562A40885F7A3C950C4FB87374686C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 1fcb619f46c88a414c0bed68b493372ee5aa3cebaaf20eb890ddeca77c94a4e8
- MD5 9a30280b91a401bfa56a8ab03bb583d5
- SHA1 3a103cc90f86793cc7fe84ee253e698ccb9dd9d3
- SHA512 631296efb2866d8becc534cb1fc17e1029867280839c4a2212b541d4d0cc4bcfa2696f9dc7981b4d88af339a28c0ce57629bb66524b6782d2a140d59ffb4e1b4
- TLSH T1E641BDF793B4957E8A0192F4EB15AE1FCE690924131C3CA688D4AE1B43F2972D10479F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 b7f6ff326bcb0fa81041302da7fc2a384edbfc3e3f40f97cf3bf12b7d21455be
- MD5 69cb5309b342b492d70e0252fc8784d5
- SHA1 6e4d1684655ea61c58d226ea9efb3f572db4e946
- SHA512 af6f4152e10f85cc18ff33ed0e7b8690cb39ccbfcc06efe060227e2f03a2e9d9b65f50605ad739a33ade9dba939b0fadf877873de238e14e1a60eb339d9efb09
- TLSH T1AD419BF793B4957E8A1192F4EA15AE1FCE690924031C3CA288D4AE1B83F2972D10079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 0b5cbc54fdb034ae8bc7c08bdb2db9bc3074a6f547d000c9612de9422d35c555
- MD5 52ad8ccdadc0011cef73d0d6353b196e
- SHA1 e7bdde10610a9c61b3403bb13ab7f385ed5c7afb
- SHA512 400bd2a96907fd9b716af2921d235ba677351af2542f91a6adfffca70f929d5b3963738e2c0fd109aeebbfe87b276fa18d0965f11d80b7f79143fd319a5d7a41
- TLSH T1BF41BDF793F4957D8A1196F4EB156E1FCE690924032C3CA288D4AE2B83F2972D14079F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 429d5c6819ad0ceb48296c8c8001d0b5f87c5975675f7103710cc344554c19c7
- MD5 4fae7ce0d4ca45f7fe797d6511bc012c
- SHA1 bde8f590cc11903382bf382d52355fe029df6b89
- SHA512 fae7c1f9bc184c52ed3d2da6f97da5e7583a25a8a7849ed3c8d65187a9e466fd82a969fdaf07bdf5d856c6c1aabb5b5672ddebfcf019d5e2b3a31c611d45dee0
- SSDEEP 192:XRc/TqCy1Djv7+pAPRp2cf9wHsb+WNnP5PWkeMKSPau5AfHVyIsnAUge:XRcrr0b6UXlOwxPfeMDave
- TLSH T14D42D72EAA50657B6CCBC72EFA217B53D7F5103621D42E84E6FC8A1C15E75CC222712B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 6d5396efd43c586a517ea6233309a6a23094cbbf0680be6d40fb6db72895ee4e
- MD5 20bf7895e27e175ef0c5424775864952
- SHA1 0cc8c2f1b6d75fd349939978d4b3a8af22f62b14
- SHA512 ca546e36ed60a91d1f98b6b6a9387d1951e17abe2a280d7cc00da8a6e38961a3411aa787dc8aed1f499eab27dbdf9e1e6b6225631689f2469a4d119eeb9826d9
- SSDEEP 192:XRc/TVCy1Djv7+p8PRpGcf9wHsb+WNnP5PMkeMKSPau5AtHVyIsnAUgE:XRcrc0b6gX1OwxPleMDa5E
- TLSH T1E852C71EAA54697B6CCAC72EFA117B53D7F8103222D42E84E6FC8A1C15E75CD221712B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
- MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
- SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
- SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
- SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
- TLSH T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 2448f5a2a1d57aa02fd123d961239aa7ea74e2cebceff662aba05c857c8817c9
- MD5 556b8594d0e15e9a15f1b7e7b2f5b140
- SHA1 dea76e27967d966ce2fd3e8d97e80aaba77a924c
- SHA512 e17bce5f76974818a8c659d63b59818b512dff83f0e4c63919cba09f48fdeb8c0b42a57eb358b683815ddca4d5955ce791e41b45769e6f0e8a7def797a021814
- TLSH T1D4B012498001A212C44202F51152188C7158BF10A60A170283E46D628825250C01C450
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5877ac.TMP
- Size 96B
- SHA256 6087e1a9f2cd9d8308b5d445f50ce7425898da0fd2422bcf73a8011062504e61
- MD5 58aa26ca37b05b46344e187f8ed499f0
- SHA1 80e7a4b74c08e69ba0b891893f200d4f9c367dd3
- SHA512 d18fb7a5ff141b9cf53380afe0a57089b3468b0c2abad26233f8b6fbd548a0b9a715d94d77b7d2fa301a818acf11d68bc65ae1bafdd01b41ec650fcdd9bb74a5
- TLSH T126B0025AC1066293C04A07B139A595EDB576EF25CA07221BE2F02F77DC2566065299A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 5f6b05e4c0285ef17bb275848c05f446f5d3bb7fcaa151747d4dda56034f53d6
- MD5 bec46587d2245cb99c530b3fd3cee2db
- SHA1 a78b79bdfa2175125bffca34ff1914bae6b85839
- SHA512 934f5dd6ff4c3c3c894b8a720a9190eb9bc404f6690695a69b4ee22f9b29256a434c2a4f057d748d1a3646950e036ff5a0b6d2dfe3438083ed1c088c77eb6495
- SSDEEP 3072:uLzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:uPWDfxA3OnjrYQ9EU0/hEg
- TLSH T113C302A15C39BC660CF8EE95B40D3E50AFF46C9B92876DC3A2E81F4C14FA5C8117A931
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 4d775e14714e16daecde4277cc81a8e074aeb016a75047d0cee044801e760c78
- MD5 8905e3e576dc04875074f17996edcad7
- SHA1 7a5db04e29c4f420ab0a7089cdd3de1e3bbd9f24
- SHA512 d10ddad014abde523eb45cd9c947b37fb8719ca55ae000739d3f903aa52e40697ed19c011bec3e31c9512e8887ea1fa948123e76c5caf2b3076e3584b3969b75
- SSDEEP 3072:AizWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:A4WDfxA3OnjrYQ9EU0/hEg
- TLSH T1CCC302A15C39BC660CF8EE95B40D3A60BFF46C9B92879DC3A2E91B4D14FB5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 6b9075aa46289e1ca77874a50f9f7b910bba5ff1139db5cf9dea8c7314a81867
- MD5 495dc97e351d139108f7e993aa0cba91
- SHA1 661a1c874a522cb2f6a234b2598ad19572f9063a
- SHA512 b3f785469fdaf6eb2217c613e51391f467ca81ca39c651ba94a458e74cfb9a2b2d6c133323a7543a1fe65b6def4b71f8b086ee5a5fa796e257e4efe81857ba7f
- SSDEEP 3072:XizWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:X4WDfxA3OnjrYQ9EU0/hEg
- TLSH T1B2C302A15C39BC660CF8EE95B40D3A60BFF46C9B92879DC3A2E91B4C14FB5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 fd9313ebc39479479401126294a70c4d9a9ef2c3aa47ce342dcdf4140dfaf70d
- MD5 6dd6bde6e142f1ec7f7fa8216cea0df2
- SHA1 82dbd88547ecf14538c7b112bb31d0ada3ce6cf2
- SHA512 39daa66dbc4b18552e6117bece96f9ea8b763146364d6a9ea0f34c23f800593c264370f5fac938f3b551b54128bb7c0a1461e563d1cadf5c5fea92c8fe72f525
- SSDEEP 3072:uLzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:uPWDfxA3OnjrYQ9EU0/hEg
- TLSH T133C302A15C39BC660CF8EE95B40D3E50AFF46C9B92876DC3A2E81F4C14FA5C8117A931
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 074d256a96c9e129a3d1c64bbf1ea53256a314c96937296d2df07b8bf83d8279
- MD5 6daf2ff9f11ac0f6f4f3dc4aea9d2f64
- SHA1 739e2160dcf6192ec304acd77a5f8e79d8896151
- SHA512 7bc3cd544cf3fe7f6626fa25b7145e1bf6b664b552b03be7108f6595865ddb43cc675697503f161d3e1dc4ce61ba45e37dddf09519c5fb615390d1d78ce18f9a
- SSDEEP 3072:xzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:VWDfxA3OnjrYQ9EU0/hEg
- TLSH T147C302A15C39BD660CB8EE95B44C3F60BFF4AD9A91879DC361ED1B0C24FA5C81139930
- MD5 SHA1 SHA512 SSDEEP TLSH