Overview
overview
6Static
static
3Modrinth A...up.exe
windows10-2004-x64
4Modrinth A...up.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3Modrinth App.exe
windows10-2004-x64
6Modrinth App.exe
windows11-ltsc_2024-x64
6Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 09:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Modrinth App_0.17.3_x64-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
Modrinth App_0.17.3_x64-setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
Modrinth App.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral16
Sample
Modrinth App.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Modrinth App_0.17.3_x64-setup.exe
- Size 15.5MB
- Sample260804-kyak3awdpg
- SHA256 0e4ffd823efbe9edea9c85836bf760737519f27962447906c0b7f145c6594948
- MD5 de3715e66e6b9c285a3cfbee0b369f38
- SHA1 e2c23170a4b26544711dc0b034b5561fed5b475b
- SHA512 f969f8472ed1e571dfab6ca2dd651fb2a52f9dbd408ce46e41f456dceaaed7019228bfd48a4a2a1bbb349bc4ebc11db2f81e8c4bf5a56cd2d0b6f896d94e8ca2
- SSDEEP 393216:FyRZ/37N2a70FluLMaddFS4z8+O2Bh75Wml8AKhbhh3MVtL:FYZfx2a70zu4aS+Ou75WmaAKhFhcTL
- TLSH T10CF633A02538D969DAB3CD37D1A942447FFFF65DB312C46323AAC90CA810A055E2F75B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Loads dropped DLL 3 IoCs
pid Process 2980 Modrinth App_0.17.3_x64-setup.exe 2980 Modrinth App_0.17.3_x64-setup.exe 2980 Modrinth App_0.17.3_x64-setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Modrinth App_0.17.3_x64-setup.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3692 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies registry class 22 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.mrpack\ = "mrpack" Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\DefaultIcon Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\shell Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth\URL Protocol Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth\ = "URL:ModrinthApp protocol" Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth\DefaultIcon Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\ = "MRPACK File" Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe,0" Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\shell\ = "open" Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe \"%1\"" Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth\shell Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth\shell\open Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.mrpack\mrpack_backup Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\shell\open\command Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe\",0" Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth\shell\open\command Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.mrpack Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack Modrinth App_0.17.3_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\shell\open Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\mrpack\shell\open\ = "Open with Modrinth App" Modrinth App_0.17.3_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\modrinth\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Modrinth App\\Modrinth App.exe\" \"%1\"" Modrinth App_0.17.3_x64-setup.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2980 Modrinth App_0.17.3_x64-setup.exe 2980 Modrinth App_0.17.3_x64-setup.exe 4860 chrome.exe 4860 chrome.exe 2612 chrome.exe 2612 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4860 wrote to memory of 2812 4860 chrome.exe 89 PID 4860 wrote to memory of 3692 4860 chrome.exe 90 PID 4860 wrote to memory of 2600 4860 chrome.exe 91 PID 4860 wrote to memory of 2600 4860 chrome.exe 91 PID 4860 wrote to memory of 4548 4860 chrome.exe 92 PID 4860 wrote to memory of 4548 4860 chrome.exe 92 PID 4860 wrote to memory of 3104 4860 chrome.exe 94 PID 4860 wrote to memory of 4700 4860 chrome.exe 95 PID 4860 wrote to memory of 3104 4860 chrome.exe 94 PID 4860 wrote to memory of 4700 4860 chrome.exe 95 PID 4860 wrote to memory of 2760 4860 chrome.exe 96 PID 4860 wrote to memory of 2760 4860 chrome.exe 96 PID 4860 wrote to memory of 3032 4860 chrome.exe 97 PID 4860 wrote to memory of 3032 4860 chrome.exe 97 PID 4860 wrote to memory of 1072 4860 chrome.exe 108 PID 4860 wrote to memory of 4272 4860 chrome.exe 109 PID 4860 wrote to memory of 1576 4860 chrome.exe 110 PID 4860 wrote to memory of 2612 4860 chrome.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.17.3_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\Modrinth App_0.17.3_x64-setup.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff92195c728,0x7ff92195c734,0x7ff92195c7402⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,7422691972394913641,6843913134731527360,524288 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:32⤵
- System Time Discovery
PID:3692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,18005664241565446495,5461385133848421458,262144 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,15986751900909237014,1190935847481036624,524288 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2440 /prefetch:82⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,4564418627267906218,13982994236494120817,2097152 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3292,i,2798608626819023745,17134253637526314846,2097152 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4240,i,9324193240467655956,56250727039010818,2097152 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4252 /prefetch:22⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,8334590433259365203,1711016431461443066,2097152 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,13869985588721864564,525933402254324492,524288 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,12880741522199603310,1642187044763634203,524288 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:82⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,10950029279240199845,7378995733766395519,524288 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=240 /prefetch:82⤵PID:1576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4268,i,11460446020217800630,6312715103642926332,262144 --field-trial-handle=2172,i,10094581652346482058,11712570096520505237,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5468 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2612
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 68ab4c72169c31b8cb633218901c8fa4827a0b3c581edd7207a84697bbfd11cc
- MD5 38fad22893fe38f224bdf3cba8e247eb
- SHA1 e0ad2eef21eb236979f4b4db0e1ed5931cc43deb
- SHA512 7c16931f06d47d9802ad353e67f4b767944f6430e3d77f38d054278879dab5095dfc083517c6ad3347ba27bfe16c95909fb5820a38460131422d2731b328613e
- TLSH T155518AF797E4D67E8511A2F4DA256E1FCE2D0A24131D3C66C8D8AE1B53E2873D21138E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f88b93c2fced7e012ae7feac6129ac67cac4ecc65201a713bfb904106d0cabbb
- MD5 21bbd40435864e23501b612732ab9a5a
- SHA1 9c76779d9751bcb0c234cf109f2d2a6dfc8dae9c
- SHA512 16bfa9e8c147fd0b93e5be52912710deb60cfa5feb47629a15c08194a288a930cd3f38cef64b6e7b5afd3177e5ecbd4fa636053e5bcb2bd1fb79225075f7116f
- SSDEEP 192:IROfYEowBJuv7cpAPRp2qg9BHsb+WNncpJ0JeMkwXaXanJXgoqNUL+VyIsnAUge:IROf1KwUXlgrwQ0ZcabL2e
- TLSH T17342D72EE924697B5CDEC229F9157B63E7F5202221942EC4F6FC993C14E75CC222711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
- MD5 248039e3512518ae98cef47428956f17
- SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
- SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
- SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
- TLSH T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 8a67c14b5687ab68947100275eb16d2b673d817cd9bc77c31362296bfeb46fd7
- MD5 892517a077f7604a0d5b738f176be919
- SHA1 300b45a1027e3b566ef372db4f07e941d81c7444
- SHA512 f5087c1689d8d6d54f57f81f7195c228908a8cc1b9c8869d75b0cb2d3295a5a5928424b9aff23ab21a5033135330b4556e7f1cf595bf91f71b36354ae589a727
- TLSH T1CFB0124284015101C42607F43987148872149F24D70A1B0253E46972882B1508014190
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dcce.TMP
- Size 96B
- SHA256 fa250781f010e73bd4cddf448280ef5316f9afadd098fe1b1120298ee09db37a
- MD5 5425675b0995f4c02d072a6ccbb124a6
- SHA1 369f0de887514dacee5842bd48ea1afedff93ce1
- SHA512 5eb1b7d29a9fca38008e2678515df92a1c854942a95e218b433a48004b8d606331566bd28588bd733aeb1109c2244ba77bc306953a41cfba90824e110ecc79f3
- TLSH T1B6B02288CC022322C80A03B028C280C83220EF20CB030303C2E00E32CC30A200830C20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 2b371c9f2cbccc046a0ed44793a4e51f88bad4419dd73697eb745b8fbd9c5132
- MD5 ad1842ed15a6711554539e5c4922f30e
- SHA1 d04a0ee4227358bfcee327641f5610c83984cb7d
- SHA512 b6827991a68efe2c0800ac6aeaf7cb6f68ca709207ee8c4188469e286e995b9bc460dd35e690fba024f37d2cef77f864e4183d32d3cb7a8a93036bedf43f1090
- SSDEEP 3072:S4FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ6:HFmUi21rSm8uUVNSlzY6
- TLSH T193C3130079E7F8B2EE9930447AEE3A158D680D818291C6015373AD415DEF3C65FAFB38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 4e0b2caa35f6234e7fd5dc2062fa1664bed9baa257994e642c36aec2dc614564
- MD5 2809d765ce7f594110b4998d68cd044f
- SHA1 2c5998c6def3b4489404bb8208f39b9bd2010ee7
- SHA512 5de21663061ee42438e9169d7cf2293f2e710786365d789c81f1a78368edfb295e8bcd1fb0b26819ffde4500bf2e37747b290b1ad4a04627f5d6ca253fd1dda1
- SSDEEP 3072:SuFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:XFmUi21rSm8uUVNSlzY/
- TLSH T125C31300BAE3F8F2EE5930447BEE2A145D6C0D818191C6415673AD419DEF3C71FAAB39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 3c5e6184176611c50bf69656dcb3755c24abf27bb86eb125911b60ab290f454e
- MD5 ea683dbcd73542815fd48fe65d663bb2
- SHA1 a5b03ee57054611bfc61a388604b2a46f1897880
- SHA512 bc6d8cfd3f13f839ebd7365d489c04bfc2bb696224ff8655b1721649ef8fb9cb7eb360cf39fd15c40251587d8a755bcc1a30b941ebace576073024ae87c2b12e
- SSDEEP 3072:SEFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ6:bFmUi21rSm8uUVNSlzY6
- TLSH T1F2C31200B9E7FCB2EE9930447AEE2A158D680D818181C6415373AD419DEF3C71FABB39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 71922ff0abc82e528be7c10f7356de96efa9f41779ec35a987033c850d961cdf
- MD5 eb6531134e16d5b2b4927610d707edad
- SHA1 1f6f76be6f039dfe1ee20e6cbb5aa958bb200304
- SHA512 949c8a436e98d3e7ecfc5c94a60db9999573257a560663c138a1031013c9e5ad96f2f956d2feca71c21131b8a7970553a8d7da03a8629e570dcc8e623d62b9ca
- SSDEEP 3072:SPFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ6:SFmUi21rSm8uUVNSlzY6
- TLSH T12CC31200B9E7F8B2EE99304476EE3A159D6809818191C6415373AD419DDF3C71FABB39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl39AB.tmp\System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl39AB.tmp\nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
- MD5 6c3f8c94d0727894d706940a8a980543
- SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
- SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
- SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
- TLSH T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsl39AB.tmp\nsis_tauri_utils.dll
- Size 30KB
- SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
- MD5 fc4691e51cdfac476b2fc63bbe951e82
- SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
- SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
- SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
- TLSH T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
- MD5 SHA1 SHA512 SSDEEP TLSH