Overview
overview
6Static
static
3ArchiSteamFarm.exe
windows11-21h2-x64
Changelog.html
windows11-21h2-x64
6ConfigGenerator.html
windows11-21h2-x64
3Manual.html
windows11-21h2-x64
6UI.html
windows11-21h2-x64
3aspnetcore...ss.dll
windows11-21h2-x64
1plugins/Ar...er.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1plugins/Ar...es.dll
windows11-21h2-x64
1Analysis
- max time kernel
900s - max time network
878s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/08/2026, 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ArchiSteamFarm.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
Changelog.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral3
Sample
ConfigGenerator.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
900 seconds
Behavioral task
behavioral4
Sample
Manual.html
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral5
Sample
UI.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
900 seconds
Behavioral task
behavioral6
Sample
aspnetcorev2_inprocess.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/be-BY/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/bg-BG/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/bs-Latn/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/ca-ES/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/cs-CZ/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/da-DK/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/de-DE/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/el-GR/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/es-ES/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/fa-IR/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/fi-FI/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/fr-FR/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/he-IL/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/hr-HR/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/hu-HU/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/id-ID/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/it-IT/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/ja-JP/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/ka-GE/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/ko-KR/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/lt-LT/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral29
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/lv-LV/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/nl-NL/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral31
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/no-NO/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral32
Sample
plugins/ArchiSteamFarm.OfficialPlugins.ItemsMatcher/pl-PL/ArchiSteamFarm.OfficialPlugins.ItemsMatcher.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
General
- Target ConfigGenerator.html
- Size 217B
- Sample260808-yer8nafc48
- SHA256 c84612492a0c63c053074024dce54fd419936d99ab39980cbe0d885559843ea5
- MD5 481d836e09f87acdf5a12e93998a154b
- SHA1 6a53601cdc46207f04b23412e2f53f6382c8a04b
- SHA512 9736f5cb81de5968ea0aa016ed0dd38407679fd3c259ab04061eec7aa6629ea35e4a0ea9cebee853d3a17c2fb339e5d665dd27aee1fec41ded58e5de8b70c05e
- TLSH T1A0D0A7E315825C4B4AB03374D8D272B115A32A42D280171085486097FD85D11CAC3220
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3352 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306917957733751" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 4972 chrome.exe 4972 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe Token: SeShutdownPrivilege 8 chrome.exe Token: SeCreatePagefilePrivilege 8 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe 8 chrome.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 8 wrote to memory of 3500 8 chrome.exe 80 PID 8 wrote to memory of 5816 8 chrome.exe 81 PID 8 wrote to memory of 5816 8 chrome.exe 81 PID 8 wrote to memory of 3352 8 chrome.exe 82 PID 8 wrote to memory of 3920 8 chrome.exe 83 PID 8 wrote to memory of 3920 8 chrome.exe 83 PID 8 wrote to memory of 1152 8 chrome.exe 85 PID 8 wrote to memory of 3908 8 chrome.exe 86 PID 8 wrote to memory of 1152 8 chrome.exe 85 PID 8 wrote to memory of 3908 8 chrome.exe 86 PID 8 wrote to memory of 5544 8 chrome.exe 87 PID 8 wrote to memory of 5544 8 chrome.exe 87 PID 8 wrote to memory of 4052 8 chrome.exe 89 PID 8 wrote to memory of 4052 8 chrome.exe 89 PID 8 wrote to memory of 1924 8 chrome.exe 90 PID 8 wrote to memory of 2292 8 chrome.exe 92 PID 8 wrote to memory of 5268 8 chrome.exe 93 PID 8 wrote to memory of 1456 8 chrome.exe 94 PID 8 wrote to memory of 4972 8 chrome.exe 95 PID 8 wrote to memory of 5328 8 chrome.exe 96 PID 8 wrote to memory of 5328 8 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ConfigGenerator.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc179c728,0x7ffbc179c734,0x7ffbc179c7402⤵PID:3500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,13794503643166343063,16590187547425187587,262144 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:5816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1504,i,15641919541198668604,1655457285526409011,524288 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:112⤵
- System Time Discovery
PID:3352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,18235395090302539061,17674462608093474176,524288 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:132⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,10959932621431966173,15516916235249702501,2097152 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,13719563410254830619,16735903849145654931,2097152 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,1196118456131627027,3353255833328793383,2097152 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:92⤵PID:5544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,7438233745618907508,17387478594757167696,2097152 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,9047290579993995886,9024781494263356249,524288 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:142⤵PID:1924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,6582529850465925066,8860558648156293467,524288 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:142⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,18433857975653545314,15134668473427373382,524288 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5764 /prefetch:142⤵PID:5268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,11153370223136939566,8997635191217707522,524288 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:142⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4524,i,13256383221239699961,8324142791148269739,262144 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4544,i,2755133909865060314,5768620668729043369,524288 --field-trial-handle=1952,i,15026446986887162480,11520425308769454453,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:142⤵PID:5328
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2380
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 4bb226a941ba1e84069c2e5c91758ed251a91d9df1722856115bcbbfe8bfe7f5
- MD5 f58c003cd30c4228609686514d5d0bec
- SHA1 b3070909a30244d15b2401f84a3594c93d7047a1
- SHA512 fa7394a9569d6fa4f73cafd357541b89a0c5473807f38d9ebf91b7a8383f5ec2e0e11685916197754d97f265dec22eefb443d7515aed65388aff77834adca64b
- TLSH T1D8E02BA5C821BC371CFD1B6C61621745D76103172B805D1F3B3C920D8FB1A3A4285C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 378da3b52bc5f27af92c2ee3215ecfd218ebf4094157965066c2ac8850b3a6de
- MD5 9ce555cf799c6494eb5c56ddcb0909b8
- SHA1 493c21c23adc9b3dd301b0021d8c3e27d70c5f41
- SHA512 1286840fb9a7e02b579996a76d7f605b3ac61ef4bac3456a72b4a93f69d5e0662109de84d40326abf812ae216128173156dcf87df6ed7bb5c169daa8b37d15d1
- TLSH T118B0243DF3740001C3DC43F0515DD45030100FF00173110744C04444401D7F3F04040D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\74cd1945-4efb-4f86-9dca-a48f5375fa57.tmp
- Size 2KB
- SHA256 af535b519bf01f93851418189070bad109efa325837ec9f3878502a7ea0af718
- MD5 529e1f2ca22c2fb41c694a6efdb94a38
- SHA1 1e2874447864759f0833fb03f71287f613d78f33
- SHA512 057e73a0cbd14ad1f16b10f2cc091b3ddd60fb31290753ec85fd987549eec80518dbc04774eaac3e1f2df9f7027110856c20b6d3710b488e69c37638f4517e12
- TLSH T18B418CF797B4857E8A1092F4EA15AE1FCE6D0524031C3CA689E4AE1793E2972D10074F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 0c8281e7653fed1fcfb236f2bb13f5f822ad16c492e1eacf4dce9d3c71930b80
- MD5 943a0fe25daec27e5d36fdd5ee727e94
- SHA1 7cb3190ce2e2dec29d74c83461d5c6c2434b00f4
- SHA512 d53a25cbdfd62ef8108263e04c7e8c4dc3939d7a7c65322fde0ea49e86c786b3c59c1ff9b67be5a0ed5704d4474ea347052d5d3ec76781efb7a4bf3471455c00
- TLSH T17F419EF783F4857E8A1196F4EA156E1FCE6D0524032C7CA688E4AE1B93F2972D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 c334550a677da44063237c5da6097164506a6c01b7c1091b1aee01200dfadff3
- MD5 6ed6b885e33b527434ebab6eb6cff85c
- SHA1 6edc814e0ced3da24899fd30d5634a076abd5ef0
- SHA512 156a74d0c74c22e9b1e31e16743110bcd51e30deb1edaacffef5d8a18f310df8e1fa9d253cbe1901f8f8d29eddce67ecb203a43a3bfb28fd345cfd6018ba5209
- TLSH T190419EF787F4857E8A1196F4EA156E1FCE6D0524032C3CA689E4AE1B93F2972D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 1170733841bb7bf21feb45851039f35237b97a184090c2c0e5e8eb69cf8b2458
- MD5 2d8b8720174b067d5022e35fd3a3ab0a
- SHA1 68c2ce5db6abfbade3552bb63a719bbb6595a0a6
- SHA512 574a5e48550af4451f68c8b1d6698c00d23c14723dd5f6841352b03c822fa7694aeb40e70768a2f92320a841a8b9dca26a3efda8b3a8eb4b78534adf42d2a8d9
- TLSH T1EC41A0F783F4857D8A1095F4EB156E1FCE690514032C7CA689D4AE1B93F2972D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 687B
- SHA256 54058390f3e58871c684c02857ea04c2e72c52253b79d2e3cad98c6464361f10
- MD5 ba17e9fc55dca664b2bf791ab315ec41
- SHA1 7242c24435f953d5cd665bcab444ee2d5ed3ae81
- SHA512 43a1434c0c747d12173879e146e6157a9bcdfa5058705152640b9ffda9286a566904689cbf478e9cdc0f091447f313cab4bc50ea22c4f277129c9841db78343d
- TLSH T168019EA7E7BE745740FB05EB5E047809257AA835428159F9CF9A812CE0874E30F02067
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 bac52f94a8134b3326da27c75cb90b44d78dd0a69babf75d68d87cc13d0bd3c5
- MD5 8076c43081bb27833640204593b341b7
- SHA1 ac4a92a890831bad19f3cf49bd8845af9c564ba6
- SHA512 59723b31cf0604ea9f5bc4ac11d451544ce515bf347577dec2c7e40013b748ecab96a9f6ac7bb7cf8219bdc57f240c36e71b6e95128d3edd89537961ae980818
- SSDEEP 192:sRP80Duvr5nSlKmw8v7HpAPRp2I/lA9DHsb+WNnsbPc0eQWVyIsnAUge:sRkdFSQojUXo5w4PPue
- TLSH T1C242C42EBE106A7B5CDBD269FA657B53E7F5103121C01E88EAFC996C14E75DC221301B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 1e539748c8c24d91394e916b438faee7836f3690e8514ac979228047ab863e35
- MD5 7889207609b27f1928e199fc851b0089
- SHA1 1fd213310e4c1c013dfa739e25cff6f915ac2776
- SHA512 b00a767d3c1a0d7d4c61ba2fa9463433a55ef7ea4f35399613694e6b1c9e8615bb4a12d6d2e4c7bcf290772edbe09cd3cdaa49b93aca6576e237901cce89a877
- SSDEEP 192:sRP80Duvc5nSlKmw8v7Hp3PRpjI/lA9DHsb+WNnsbP50eQ1VyIsnAUgE:sRkdcSQojlXv5w4PcjE
- TLSH T18852E62EBD106A7B5CDBD269FA657B53E7F5103221D01E88E6FC8A6C14E79DC221301B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
- MD5 a9125c26694a66613be5174b13bd716c
- SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
- SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
- SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
- TLSH T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 4d350a9bc4603acc00fc506fbab64b81e3fa265b7d0e8daeba75d5ad195e5af7
- MD5 5480fb3a7b76bfb67927603f53697a43
- SHA1 46a0d9e3e328fa0b69061605266e66b31f06ee1b
- SHA512 4bfd64c273468ba72455c6c9187b6972ddebf28d47f3cc07a5f392faf4e96543eeb9513c20c317232db410c1e24617ce4222d5bad354953dc025baa6df07a320
- TLSH T188B012D080425105C04212F41542588C71989F10960A1B0943F0AE628825161C024450
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b699.TMP
- Size 96B
- SHA256 2fbd2d02982d16a1314fb8337d3f21cffc8886d82f2a7fe7bbed413459dd7df6
- MD5 8044e3e29b6c768a4ec1624b48d1a22d
- SHA1 dc10c677e81d0b0d86912851aa6e1fe460f719e9
- SHA512 0d8d25f6d76db8786acccd51725210a557b03dc6ff71ebb2e628a83f2dc939303bde6e69ba394a06f5077bd5e1073b43ee43eca6179126f5b55a636d9b3a7566
- TLSH T14AB002D6D9026777C44743B02D99A5D87260DF29C603171A92E02E6AFC37AB04525D78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 4e9664089ddeefab09ef43771857dd00fdd586f3293265f4a8e66b7135452907
- MD5 9507e1c3c811e5c0abc3b313ab9d1ba2
- SHA1 259d32b995e4f98c6a9e7dbb1f0ec5704ac1e361
- SHA512 56a7740bfcec1c4326b85d7230a85a8579483f261e1f9a931b9141301c1d3c419c24a9bde21e4f78c0426cd724e918e7528a61b6b6da9bb92d218e53319bf428
- SSDEEP 3072:NtGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Nkm7Rkm1tYpBeh2BAo+
- TLSH T162C3122B5D75B97658B9BB0EB04E0B1F1EF149A6C930DE52C8D86F0423FA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 f99b67f7d252725a13176c87a8d3bcea2aa0e76aae092bbf66a60853d1ef9b7e
- MD5 5b3f21d3944c66ed22e9dfeeb39137ae
- SHA1 43315e5bbe15410059fcc0e488fc8dab042a644b
- SHA512 8f06eec43022ccc5e40edf02f0ac03f66f118be05ba310c3e303df6d633f5b92f1a48528761aa53f7e3a2667b799ea34b6e2810ec04590521dbdc610cc0043ba
- SSDEEP 3072:N6UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:N6Xm7Rkm1tYpBeh2BAo+
- TLSH T1FEC3123B5D75A9375CB9BB4EB04E0B1F1EF149A7D930EE52C8D86E0423E66CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 3e1ea11ec91453b287559f3e5dc8f002ff5aafe99747f5c87a51ef63fc10e7a6
- MD5 fa20fa75f7336de7df7be43b21f3e658
- SHA1 e140d8418aae20ba26e5e3937713e220155ed477
- SHA512 55912aeea9e3235b8f4300fee6c39e35bbd5958ddd5217da3b1561e9eb731e0eb647f703a4d3faf2badd76b234dfc24db79297bd3f165d85022ee153fc9ef0fc
- SSDEEP 3072:wtGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:wkm7Rkm1tYpBeh2BAo+
- TLSH T16BC3122B5D75B97658B9BB0EB04E0B1F1EF149A6C930DE92C8D86F0423FA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 1cda2443af45d2d922a4124e1ec25b81c7cbb5bc1327d161271507acf9a8f76b
- MD5 f4e1cb9cf4dcfbf4169525eb3517906d
- SHA1 4203a9143d4e4c4bec57e9e809bde4cbebe88f28
- SHA512 ea7bd32a5a902f524de4002c889eaee905c718388d8639897bcbe7505045fa4e8d94df87eed6bf7aa3ab4363e425957960d5772bf07f940e9b2f089c8dad7d1c
- SSDEEP 3072:16UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:16Xm7Rkm1tYpBeh2BAo+
- TLSH T193C3123B9D75A9375CB5BB4EB04E0B1F1EF149A7D920DE52C8D86E0423E66CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 af8d3c721738cf8ca50ce3d9e95a22d8fe89d661b31b22deaf4f0ef11bffc345
- MD5 43b4343682bf22dbdb5ced250a7489fe
- SHA1 5fc31cef20cf0b65107d02817786a00f22b5b4fa
- SHA512 5b58b974d6d552804b4c82a2fef1d0b229e37a6795646e6ec88b596ce5caabcc4962d9c98b913911c595954667a39bbdea00bce784fa85aa5795e5d27d0c3fde
- SSDEEP 3072:lRGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:lAm7Rkm1tYpBeh2BAo+
- TLSH T1E3C3122B5D71A93658B9B74EB08D0B1F1EF14DA6C930DE82C8D86B0477F67CC1A04A34
- MD5 SHA1 SHA512 SSDEEP TLSH