Analysis
- user interaction
yes - max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
tcv-multiplayer-mod/Install.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
tcv-multiplayer-mod/Install.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
tcv-multiplayer-mod/mod/patches/common/scene__match__match_master_base.gd.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
tcv-multiplayer-mod/mod/patches/common/scene__match__match_master_base.gd.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target tcv-multiplayer-mod/Install.bat
- Size 2KB
- Sample260814-rhnlbadk21
- SHA256 860f7bb0ff0459b19526a31a103fd26b598cceab12b297e5175441c00572be9b
- MD5 c75f1a5e0aa1eb3af1bca191bb9f998b
- SHA1 ca665c6fcaec1d419f7f0032af30272a98300404
- SHA512 26c6901eda6d99b7154cd6c6314d35d8456310bef760084b4496fd59f3b5a0be89370f1049db89e68edf85316e56446ba4579e8722a17ed4f8dd8db5a8004200
- TLSH T1F551624F37409237BCA35AAA9F1E2B44331814F75296AC6998EF8034321BCF67579093
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2872 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4632 chrome.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311903778447945" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 6088 chrome.exe 6088 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 5488 taskmgr.exe Token: SeSystemProfilePrivilege 5488 taskmgr.exe Token: SeCreateGlobalPrivilege 5488 taskmgr.exe Token: 33 5488 taskmgr.exe Token: SeIncBasePriorityPrivilege 5488 taskmgr.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe Token: SeShutdownPrivilege 6088 chrome.exe Token: SeCreatePagefilePrivilege 6088 chrome.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe - Suspicious use of SendNotifyMessage 61 IoCs
pid Process 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 5488 taskmgr.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe 6088 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5488 taskmgr.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4884 2872 cmd.exe 89 PID 6088 wrote to memory of 4148 6088 chrome.exe 95 PID 6088 wrote to memory of 4632 6088 chrome.exe 96 PID 6088 wrote to memory of 2484 6088 chrome.exe 97 PID 6088 wrote to memory of 2484 6088 chrome.exe 97 PID 6088 wrote to memory of 2752 6088 chrome.exe 98 PID 6088 wrote to memory of 2752 6088 chrome.exe 98 PID 6088 wrote to memory of 1332 6088 chrome.exe 100 PID 6088 wrote to memory of 1332 6088 chrome.exe 100 PID 6088 wrote to memory of 4136 6088 chrome.exe 101 PID 6088 wrote to memory of 4136 6088 chrome.exe 101 PID 6088 wrote to memory of 4976 6088 chrome.exe 102 PID 6088 wrote to memory of 4976 6088 chrome.exe 102 PID 6088 wrote to memory of 3492 6088 chrome.exe 103 PID 6088 wrote to memory of 3492 6088 chrome.exe 103 PID 6088 wrote to memory of 5784 6088 chrome.exe 104 PID 6088 wrote to memory of 2340 6088 chrome.exe 105 PID 6088 wrote to memory of 4524 6088 chrome.exe 106 PID 6088 wrote to memory of 2340 6088 chrome.exe 105 PID 6088 wrote to memory of 4524 6088 chrome.exe 106 PID 6088 wrote to memory of 4820 6088 chrome.exe 109 PID 6088 wrote to memory of 4820 6088 chrome.exe 109 PID 6088 wrote to memory of 1316 6088 chrome.exe 112 PID 6088 wrote to memory of 2948 6088 chrome.exe 111 PID 6088 wrote to memory of 1316 6088 chrome.exe 112 PID 6088 wrote to memory of 2948 6088 chrome.exe 111 PID 6088 wrote to memory of 5620 6088 chrome.exe 113 PID 6088 wrote to memory of 5620 6088 chrome.exe 113 PID 6088 wrote to memory of 1676 6088 chrome.exe 114 PID 6088 wrote to memory of 1676 6088 chrome.exe 114 PID 6088 wrote to memory of 5572 6088 chrome.exe 115 PID 6088 wrote to memory of 5572 6088 chrome.exe 115 PID 6088 wrote to memory of 5680 6088 chrome.exe 116 PID 6088 wrote to memory of 5680 6088 chrome.exe 116
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tcv-multiplayer-mod\Install.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\system32\where.exewhere winget2⤵PID:4884
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2632
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffbcee6c728,0x7ffbcee6c734,0x7ffbcee6c7402⤵PID:4148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1848,i,4700262203519517754,6788615693782063624,524288 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:112⤵
- System Time Discovery
PID:4632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,13261955702419519260,14112796513034081759,262144 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:22⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,13031671883018025184,10836384845965786877,524288 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:132⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,5635115302371220916,17331910457430914301,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,16865579615537785297,15365304705240046029,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:4136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4692,i,16585268568461603106,9673762692755528464,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,11746263616030446203,5949833514379386883,524288 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:142⤵PID:3492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,5066246740422069558,7190133316138391085,524288 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:142⤵PID:5784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,16694700967999286957,2666440707496863002,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5508,i,10471475506523079009,2872356657442845712,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5792,i,13789568312525203293,7539785519641284503,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5812,i,7264830844767138718,6993365683790731329,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6092,i,11739275663484690345,2844873424910092088,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:1316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6000,i,5777889561400770750,10040882459352674945,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:12⤵PID:5620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5992,i,16132139803750667687,13739102529659066496,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5588,i,13827901332019601302,8572008098078031701,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:12⤵PID:5572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5640,i,7111608082931717410,12551766686741500343,2097152 --field-trial-handle=1864,i,16508509770354857676,1841525342949972830,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:5680
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:3756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
- Size 335KB
- SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
- MD5 9f9c9ac1a584487d0961c6af2cac057c
- SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
- SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
- SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
- TLSH T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 4a6a1be50a85fbeb45caeb4656557284aa3753df2427d21c796f0e971280e4fd
- MD5 8caf2be05aa55b8343c8f7cccd8e6b9b
- SHA1 84f410465855e3d5e987bb8e25fd723d4f469261
- SHA512 12c0579071a31a52f389b9028df1b11869684ea573d8b8d29dc1f6149b2ee9f2db4aaa46cb571a352e8a80c559dbdc922d091f34371086fa94be2ea045e901ca
- TLSH T11DC01248228D14D5C79854B405618D7011555EFE7C62DB5BCA980E9FDC133F1B006902
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 0b4755e5e2825ff1d84de5df74bf87d80a66312f83a5daf83cac0414e3b1f0df
- MD5 a650b6994fbb909940bbb7279f7599fa
- SHA1 628d76c1800b7e51c2912dcf389d24277b46a6e1
- SHA512 a5dbbfdef2e3255249afa0e8625cb3c34ec8be92023c2347c10e730858cff565f70e468c8afc6c2498314566725fc7442ee20f3a8b49dcbf13517c1bbb0c18db
- TLSH T184616DF7C3D4896D891156F4DB216F1FCE2A0A28432D3C66C8D8AE5F53E2972D21178E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 523B
- SHA256 41240be214939d40aa9567cf2f557f5d6803697bf6301ece3c4934f6c206aad9
- MD5 1f28c9b731be4d1f723d59c8dc421eec
- SHA1 67c0a58c9774b1ae6a40f186176d2010d36c7c68
- SHA512 c9a354a5f129a819263ae4a6c3c8c7e6747af62883b09fadb2caf737bbcd3e66f188768ec7188df392ace0f920d5ebcb1341f11d090730b2a530187510e7a564
- TLSH T11AF024A7A67ABC63107B957F5D04BC0AA975E836026099E4DF6A822D90D25F30B16443
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 74b4028a641976bad30311cc935b4c4f07562b6dba4705872db65bb859061c5a
- MD5 5b2c8c30e17bd227fa549f04383753aa
- SHA1 b9f6dbfc3e1685a8f365d7df26320d397224f1dc
- SHA512 e296b3dce3950b2ca9b1839ee2fa3fc86d530e59c9fecaf4b82310f4fe5e9392edff0fbe6b649cd55505ea4e6078b753e8ad533b908232d08cea7f99ad380e44
- SSDEEP 192:CRI+b4fzvv7gAPRp2X964Hsb+WNnTo0mgeLRl2T/DVyIsnAUge:CRIMMnVXUbws0CRl2T/le
- TLSH T10442A63EB964697B6CCBD219F9217F53E7F5202221902E80E6FC992C15E7ACC3227017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 fb1973c4731db9292fcc2979731834bff634e91feb61e5c5d9d9e52d2f7547d7
- MD5 757b8150b2aadffea2baacc25ec24f5f
- SHA1 e43ffa7b14b421713935a5fd926c413745839448
- SHA512 45db2b4ae0fccab2577f24e75fcb163397f31be691921a8e6e207b25e5703cfe17ee1f7bb092058f7daeb5a2349313835fc9c809d367985575864c94192f697b
- SSDEEP 192:CRI+b4fRvv7gAPRp2EuT964Hsb+WNc4To40z2ygeLRl2T/urPyIsnAUge:CRIMAnVX6bwuz2GRl2T/ufe
- TLSH T1C442A63EA964697B6CCBD219F9217F67E7F5202261902E84FAFC492C14E7ACC3217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
- MD5 f1d1ecef56c7515367970c4fb9982059
- SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
- SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
- SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
- TLSH T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 4KB
- SHA256 786836ff6014566d5babf5ec898e154183cdf606e88eb34c8c3ce829eb8f063d
- MD5 5cc7ce22306f39ebba0b85b42a093a55
- SHA1 986879f593173ca754d0ec6cd473c0ec7a931f5b
- SHA512 dfb411cd46703cb9be9ebe262d64572278eaaa393320b871d04a3dc00130eac291ff4651aad73ccf23622758b9661ca4fb39a1eabe60759913029569f3b14d8c
- SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5OCDtB6/dGyv95Schbb2Jv4a:gC0LA/TE57cDUD5zUweSchbKl
- TLSH T170A11971B8A95EB75C75D544F5827E83CF68A157A9226F80DCED1F0C10E70EC2382A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 128KB
- SHA256 1c3454b631b14e309873e9994798cbc036a822c33e8d8edc604f90ee5797e421
- MD5 3e91feaf9b7223daaa6f7a97e3f83885
- SHA1 15cafb93c147b0d5a844942f4c91a0fc28fa9b43
- SHA512 4b02e47ab7e12823eb2ef2bf98ae0adb3333b31469dd9c4d781b37c59f58409b82410f185b0b1f1b3360b5a27b3d6fc3a136222f823dd8ed9ec91447b0feb56c
- SSDEEP 3072:CgFnzKOYroiCvyZ81zAZdqa9CumoS5ulwEHd6LySpYetWTylw:CgRG3Cve81mEU6ulN0yzeMGw
- TLSH T1B5D31397687C299EE4AE4735E049B70BCE5F749158A8239C2AE38D594DF73DCC283311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 128KB
- SHA256 13cf1d56655631f2b86f9db9057f36d176230b974c07ebeb2e8437af3e048ad8
- MD5 6bc2f3fc32aa6b2be976fd6fe7694e2f
- SHA1 b0f93d18708ad2162062e02602591b8bb03497b8
- SHA512 327cda8f328c615ceb593aab3646b1b0757097f2ad388d153ba8b250b4444f8c3fa57dd068bc51a7a3028a6151d7e22545f4752eea007f01233f94234b74c182
- SSDEEP 3072:GgFnzKOYroiCvyZ81zAZdqa9CumoS5ulwEHd6LySpYetWTylw:GgRG3Cve81mEU6ulN0yzeMGw
- TLSH T1E8D31397687C299EE4AE4735E049B70BCE5F749198A8239C2AE38D594DF73DCC283311
- MD5 SHA1 SHA512 SSDEEP TLSH