Overview
overview
10Static
static
3v2.4.1.zip
windows11-21h2-x64
1v2.4.1.exe
windows11-21h2-x64
10$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/app-64.7z
windows11-21h2-x64
1Installer.exe
windows11-21h2-x64
10LICENSES.c...m.html
windows11-21h2-x64
3d3dcompiler_47.dll
windows11-21h2-x64
1ffmpeg.dll
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
1locales/fa.pak
windows11-21h2-x64
3locales/fi.pak
windows11-21h2-x64
3locales/fil.pak
windows11-21h2-x64
3locales/fr.pak
windows11-21h2-x64
3locales/gu.pak
windows11-21h2-x64
3locales/he.pak
windows11-21h2-x64
3locales/hi.pak
windows11-21h2-x64
3locales/hr.pak
windows11-21h2-x64
3locales/hu.pak
windows11-21h2-x64
3locales/id.pak
windows11-21h2-x64
3locales/it.pak
windows11-21h2-x64
3resources/app/main.js
windows11-21h2-x64
3resources/elevate.exe
windows11-21h2-x64
3v8_context...ot.bin
windows11-21h2-x64
3vk_swiftshader.dll
windows11-21h2-x64
1vk_swiftsh...d.json
windows11-21h2-x64
3vulkan-1.dll
windows11-21h2-x64
1$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3$R0/Uninst...er.exe
windows11-21h2-x64
7Analysis
- max time kernel
899s - max time network
909s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/08/2026, 14:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
v2.4.1.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
v2.4.1.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app-64.7z
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
Installer.exe
Resource
win11-20260513-en
windows11-21h2-x64
42 signatures
900 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
900 seconds
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
ffmpeg.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
libEGL.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral12
Sample
libGLESv2.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
locales/fa.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral14
Sample
locales/fi.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral15
Sample
locales/fil.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral16
Sample
locales/fr.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral17
Sample
locales/gu.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral18
Sample
locales/he.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral19
Sample
locales/hi.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral20
Sample
locales/hr.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral21
Sample
locales/hu.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral22
Sample
locales/id.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral23
Sample
locales/it.pak
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral24
Sample
resources/app/main.js
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral25
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
900 seconds
Behavioral task
behavioral26
Sample
v8_context_snapshot.bin
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
vk_swiftshader_icd.json
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
900 seconds
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral32
Sample
$R0/Uninstall Installer.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
900 seconds
General
- Target LICENSES.chromium.html
- Size 8.7MB
- Sample260809-r7eppss1es
- SHA256 ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
- MD5 bd0ced1bc275f592b03bafac4b301a93
- SHA1 68776b7d9139588c71fbc51fe15243c9835acb67
- SHA512 5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
- SSDEEP 24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k
- TLSH T1C696A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2528 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307609610755195" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 2420 chrome.exe 2420 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe Token: SeShutdownPrivilege 1296 chrome.exe Token: SeCreatePagefilePrivilege 1296 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe 1296 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1296 wrote to memory of 2104 1296 chrome.exe 79 PID 1296 wrote to memory of 2528 1296 chrome.exe 81 PID 1296 wrote to memory of 4852 1296 chrome.exe 80 PID 1296 wrote to memory of 4852 1296 chrome.exe 80 PID 1296 wrote to memory of 3280 1296 chrome.exe 84 PID 1296 wrote to memory of 3280 1296 chrome.exe 84 PID 1296 wrote to memory of 2332 1296 chrome.exe 85 PID 1296 wrote to memory of 2232 1296 chrome.exe 86 PID 1296 wrote to memory of 2332 1296 chrome.exe 85 PID 1296 wrote to memory of 2232 1296 chrome.exe 86 PID 1296 wrote to memory of 656 1296 chrome.exe 87 PID 1296 wrote to memory of 656 1296 chrome.exe 87 PID 1296 wrote to memory of 3696 1296 chrome.exe 88 PID 1296 wrote to memory of 5460 1296 chrome.exe 90 PID 1296 wrote to memory of 5472 1296 chrome.exe 91 PID 1296 wrote to memory of 5456 1296 chrome.exe 92 PID 1296 wrote to memory of 2420 1296 chrome.exe 93 PID 1296 wrote to memory of 652 1296 chrome.exe 94 PID 1296 wrote to memory of 652 1296 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbd71c728,0x7ffcbd71c734,0x7ffcbd71c7402⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,10391033147153548680,14710563792235455490,262144 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1952 /prefetch:22⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,4051548015378507224,8708862401323460695,524288 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:112⤵
- System Time Discovery
PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,12454390648588784518,14567559806318955015,524288 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:132⤵PID:3280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,11293729962007449201,10770339105775960694,2097152 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,1212926987940200423,9307454679344219889,2097152 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,953614724314901837,12428605364245061695,2097152 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4332 /prefetch:92⤵PID:656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,16068945806336190970,5887756616647407165,524288 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5476 /prefetch:142⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,1213857314812684991,9935119134570528813,524288 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:142⤵PID:5460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,837328695232821525,6637077846180110107,524288 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:142⤵PID:5472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,12702069302380936547,10877249971286544497,524288 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4840 /prefetch:142⤵PID:5456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4720,i,10545499234574214557,11742774455835255133,262144 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3964,i,812713187484721376,16061321989009940665,524288 --field-trial-handle=1956,i,7929787815359057495,14312745489876980576,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5252 /prefetch:142⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 1c97d87c39fc0dffa83aa53eeed29b93573bd02999310a5feb86113e5b5154e5
- MD5 22f5affe46ea6ebc675c39e4e35b1184
- SHA1 7e985d15debbb8333ab8867a4ceb65388c69f26c
- SHA512 d1c08cd0122dcfed77857ce29b683c5a44d9cfc9852f31cd94359f04a8c351abbcc88c31fe6aff7210597d396194d81caa92637c62ad6811cc3c0bc807e27fd0
- TLSH T1B4E0ABB9C921EC2B3CFE0B4840610692D70013173A40484B3E7E91088FB1A37459189C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 dbaa23e97066c4ef8635186435d8c73e51a84fb1bb546e9f3471f642b0c4bfeb
- MD5 15911af9cec27548aa4fca4b16b9761d
- SHA1 a619f968fa389a743b32d2cba7311d780847eb93
- SHA512 a08613d45c7790b5a7eac5724e8d62c2479606ce7a08b796857e2c9eb5d06eff78324201b057f11e45e9c454eb299482a457ce51a6726593d3dc5d66167dc6d6
- TLSH T187519DF793F4857D8A1196F4EB156E1FCE6D0A24032C7CA684E4AE5B93F2872D24064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 cbba237498514f5fd5d2fe6b53b3513747c91c13daa9010ac9a1e77c5ef08ee7
- MD5 d0ada1ae08496d11195a019b298a39f3
- SHA1 534ef8768bb622a1cc29ffe09752f4f4ef37a874
- SHA512 ee373c62416c8c5f3be57167576807943795e476fed9024877b361f343df84093c5d914b0098996ab79cf1e04b3e66ab02eb04378590474baf82cee745df0553
- TLSH T1A7418CF793F4997E8A1192E4EB156F1FCE690524032C7CA689E46E1B43F2972D20078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 549a8f13df5cd29cd28fe0cc03215db83ac69a8f25fe278138d184c142239d9a
- MD5 3d92114a142467497b0be5084a856f28
- SHA1 3e7fd719af8ed10694829d9e18a405ec04269713
- SHA512 9e87bc631717d56d7c2c45f06f5f57ed3ba1b3e8bfed375c0c5da7a991ea311a8ef73747f429a2fd6b9b2da077211ad3954263675ac6f95dbbd899fa644c2426
- TLSH T10F51AEF793F4857D8A1196F4EB156E1FCE6D0924032C7CA684E4AE5B93F2872D24064F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 be6527fea580236c14cb8df36e8facf0574f66289937f7453fcb62b781c118bc
- MD5 eb855d2a9efa2de5612ca86a262a73c2
- SHA1 e17ce2a0d2a6de2b0f1b4d9f470b5e73f4f77de8
- SHA512 3a0bedc5feacbada5dda08dcb82df55f7d407f178b2d9818d887cf44447b5f3438d5fc566aabfa0a4f3f0ae08fbd54b75e31ff9c09034560a6314f40820cffb5
- TLSH T13051D2F793F4857D8A0196F4EB156E1FCE690524132C7CA6C4E4AE2B43F2972D10068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 6c90924776aa34f00e6ee3d1426b3fa72e9c07cefb653d01ab42ad1c99c932d2
- MD5 a5386e4de0ae70e9481de0e7a1cc4f1d
- SHA1 59e5bf9b5f7e1f8d15c2ba31bd8410e125ff02ad
- SHA512 12e1567e19d54abd91ac26ca75b3fd5bb89b10f71601a0e1cf97f3d7d99688ebf9e3a4af0465e38caeed93ca9640eba29adc1216d6d1ffcefb1a30fab540328c
- TLSH T158519DF793F4857D8A1196F4EA156E2FCE690524032C7CA6C4D46E1B83F2872D24068F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 97123ad6dc30c4e12012a774593f08b7a814799d7d04034c677d80b149799720
- MD5 62c93c64cb46303572381de5170566fa
- SHA1 f9985add693238c0f6c34c810c5a5ecd93c8ab86
- SHA512 50518083ea281971ad385699dbc227d9a76f41dba9fb8c91a51a171fe23afa97c2c16adcd35bdf7b48d4f0848f00d23ecf5a4148c2dfb675133a4343a9fdf8d4
- TLSH T13D519DF793F4857D8A1196F4EB156E1FCE6D0A24032C7CA684E4AE5B93F2872D24064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 1e8428275361902153ad3e5c96847213d6a04b2b6113acb15c70bf01c15b1a85
- MD5 0647f2a345d482da12f1667453f9a84a
- SHA1 08db2e86f9431b7747d6517d9212ff5aab50a91f
- SHA512 1b4b66b5f5b6103210940bfcfd089afbcec40546ab6c6e5f607c62012911ac6c4f939f56e5350a0ffaaa229d58f7573e1cf8c0bd551cb5848bcec49bbb6a67b3
- TLSH T16251BEF793F4857D8A0196F4EB146E1FCE6D0924032C7CA684E4AE1B83F2872D24064F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 3f6d7ea1cd6ad7763b72364c8b9415c189f0bd16f06b6e4f80a6670f02b0af9d
- MD5 b37bee1f24e731f646cc57309f775b81
- SHA1 d8a210ec4aaa5e91467c9c1a9acf10e9aaac4ec1
- SHA512 134b6bb30fe3fc69de930cb06f31a5929ece04d65c8c6daffd51dc1ebf2d0d41b5824e5c4c658e144017c361e68df371363cd4a0628cb4fa3385ac8ae023575e
- TLSH T183F02BD7E7697023517946AE1D48B8091A75A832028128F4CF6AC17C90415A32F02843
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 e490562e1e724c3406b0ea8ff34fa66ab5e699b4fb9afce8cdd40d5c09761a24
- MD5 68570958ebee3d1a265357b0a3af2ede
- SHA1 9ce1a328b5d83740b4f023d6aca054b538752718
- SHA512 a62193ddc82e2cefac470a3ff27a52c3bc6b5c2157053d02e70fcecd3dd1da0c61e4a454a6ff7fa8ecff1abc76bb6ee2bbff9e90fd2f808585054ed01c29ba6c
- SSDEEP 192:qRff/CTlcOiAjv7lpAPRp2c09+Hsb+WNngGPf7oYAUOtVyIsnAUge:qRffUlGAbRUXq0wNPzc7e
- TLSH T11D42C67AEE10697B6CCBD22AFA157B63D7F5202120D42E84E6FC892C15E79CD221705B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 b34c91e53d5a1e7ebacb1083292f246c611fc3592c4defa8ceca256d1e4819a9
- MD5 93924986a3752c588fc37077edcf6185
- SHA1 770378bbaed2ca502aa47d3b41f07055845aefb9
- SHA512 75bfc501a0048069fb7e1e880c221d3b3db2dae40e0601862546066fbf08cbe5b9bae7fb12e117058352cb713b5f507b02b6bf424a4a5f1d11d33c423d9b4149
- SSDEEP 192:qRff8CTlcOiAjv7lpuPRpEc09+Hsb+WNngGPI7oYAUOoVyIsnAUgE:qRffjlGAbRyX80wNP+cME
- TLSH T16D52D77AED106C7B6CC7D62AFA157B63D7F5202224902E84E7FC892C15E79CD221705B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
- MD5 9365e110646fce4577746230e9396c69
- SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
- SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
- SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
- TLSH T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 8b130232894555b756e2fdd1f717c5c2b311be8f33dcf43fab32440775e7e590
- MD5 f67ce8c124c58a383a7b8711537326a4
- SHA1 54a299c8d051d5756c269e8a9776e3a13452576a
- SHA512 2f4f01bdc1341c53b76c348fe9469f1e4f2f41092a8c44a625d9dc668b75abc53921fe492aeeb7bcb797d2f3509b05a8068d6bc3611608939d60e8e0eb25b770
- TLSH T164B01240C001A141C00706F4115B1488F124BF20A70B170343E46932882559185181A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e4dd.TMP
- Size 96B
- SHA256 b39b6811f069951f284db4c7eb0e62b7ad7cbeaf0e9c40de680937b44a95a924
- MD5 c5832586e55f683bbb4bb010b19f66d8
- SHA1 e008e414ef39bfa5048f227ad615ab68d2401862
- SHA512 242379c6f730ccd3e8d1c173ba2105d8e825c0ebd2f970734b36e5359588f8bf293638ea6acebf27831b163a81a4cb4d771208a9e648c7c6959f8d70db353467
- TLSH T1C0B02208C2822A22C00303B83BC280CB30B0EF20CE030A0382F0EAA3EC222200020020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 f11f8a38eeb98504478bdda2b110cc8c0db31d23877dfa3e85290b9b28609f0d
- MD5 2a43774e68007db94e5d25f5292e2620
- SHA1 c3ed4ae04f65482af46a9b8cdfeb9a1decaa5d38
- SHA512 86558740cab770e1a66256005cdfa9c835a133cf84dd21559e979aee915d2084cd533a8c23837a698848aeafb8f264ee6b4339b924727c35b144935de417f99a
- SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:im7Rkm1tYpBeh2BAoa
- TLSH T16FC312375D74A9375DB9B75EB08E0B2F1EF149A7C920DE52C8D85B0423EA7CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 156KB
- SHA256 6a69b2a2179c9bf7fb479373b7b19f1cd85c3a503b17ef5047fd08341586d7ba
- MD5 bfdaa40a88281f70c2168e2a09019f26
- SHA1 7b3794c912b7eb900f10fa600899ad99387801a4
- SHA512 423c592939c1d842c6d765bf4d41810dc85ccae6d6755790f6c06afc55b57732890db4827a9f73be6718f98a0b34a0efd7c9ad4be76025ce5481211cee54d3f8
- SSDEEP 3072:U0a2FmjpfztbeddhcpGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:UF2Fm+WIm7Rkm1tYpBeh2BAoa
- TLSH T1B4F3122B4DB9AC374976771A708F1B1F1EB18D97C9709EA6D4E46E0067F16CE0A0AD30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 24f361b159feda08d5985aaa2c76e131ed55faca99cb7a1e7751736770aba412
- MD5 04b58eb2656da918e2cb56a0d090f005
- SHA1 2bf12f66268fc605a3687c8bac7d30dc5910b039
- SHA512 c5a2871cc8b784f43c049b6c505669b89894d3daa283c039377d7c0cca4d00a1426067009a2c30eb090c9871f321fb84649735a7a485bcb2665e605ed366d1e8
- SSDEEP 3072:uOGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:uJm7Rkm1tYpBeh2BAoa
- TLSH T17DC312375D65AC3B5DB9BB4EB08E0B1F1DF149A7DD20EE52C8D86E0423E66CC0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 2ee45db9e16c530eb52dda1dfb99e2bd3f856bfdda4d9524ccaf67b4b2bc11ab
- MD5 10562aced538218da4e0cbe1da8e7035
- SHA1 d9a655ecb8406601822939e987014ff5863f3e4f
- SHA512 053051842dd19e3d62ca4c439b29c7329f0f321d79c9b87f99b9d9ff884a44686220f553fb79fb124acae74ebf2e5a3c46933a729198e6e76748a67811f57aea
- SSDEEP 3072:gGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Lm7Rkm1tYpBeh2BAoa
- TLSH T1C4C312375E71A87759B9BB4EB08E0B1F1EF149A2D920DE42C8D85B0427FA7CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 49b3b948ab0ba5e6c5642d5d9836d8b6f6a8a2bbd710bb15a9bbc9cceeb916eb
- MD5 fe76a780094f2b94f0270bf4afad977c
- SHA1 e64137e078908666dafd6f990dea6803afd81240
- SHA512 0435e422c34f850e961b29b0beec338a1dce0ec76545a148873e1989f5f2a6dd1c72ba89e5874e0ba8a75f9e4e00996661fc4830bdb87193ecf97b45be91300c
- SSDEEP 3072:UGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Xm7Rkm1tYpBeh2BAoa
- TLSH T12BC312375D74A9375DB9B75EB08E0B2F1EF149A7C920DE52C8D85B0423EA6CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH