Overview
overview
8Static
static
3Era Setup 1.0.120.exe
windows10-2004-x64
8Era Setup 1.0.120.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-ltsc_2024-x64
3Era.exe
windows10-2004-x64
7LICENSES.c...m.html
windows10-2004-x64
3LICENSES.c...m.html
windows11-ltsc_2024-x64
3binaries/F...er.exe
windows10-2004-x64
1binaries/F...er.exe
windows11-ltsc_2024-x64
8binaries/vulcan.exe
windows10-2004-x64
1binaries/vulcan.exe
windows11-ltsc_2024-x64
8d3dcompiler_47.dll
windows10-2004-x64
1dxcompiler.dll
windows10-2004-x64
1locales/th.ps1
windows10-2004-x64
3locales/th.ps1
windows11-ltsc_2024-x64
8resources/...li.exe
windows10-2004-x64
1resources/...li.exe
windows11-ltsc_2024-x64
8resources/...me.dll
windows10-2004-x64
1resources/...me.dll
windows11-ltsc_2024-x64
1resources/...er.dll
windows10-2004-x64
1resources/...er.dll
windows11-ltsc_2024-x64
1resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows11-ltsc_2024-x64
3resources/...er.exe
windows10-2004-x64
1resources/...er.exe
windows11-ltsc_2024-x64
8resources/...an.exe
windows10-2004-x64
1Analysis
- max time kernel
900s - max time network
910s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Era Setup 1.0.120.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
900 seconds
Behavioral task
behavioral2
Sample
Era Setup 1.0.120.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
Era.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
900 seconds
Behavioral task
behavioral14
Sample
binaries/FortniteLauncher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
binaries/FortniteLauncher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral16
Sample
binaries/vulcan.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
binaries/vulcan.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral18
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
dxcompiler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
locales/th.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral21
Sample
locales/th.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/register-scheme/bin/win32-x64-140/register-scheme.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/register-scheme/bin/win32-x64-140/register-scheme.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/register-scheme/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/register-scheme/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral30
Sample
resources/binaries/FortniteLauncher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral31
Sample
resources/binaries/FortniteLauncher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral32
Sample
resources/binaries/vulcan.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
General
- Target LICENSES.chromium.html
- Size 14.4MB
- Sample260905-lqa3asywcs
- SHA256 c16ee3cc1aa0d1669a839428ef26869d7a3844a43df505377b85077e1db14396
- MD5 adc1ff1ecd313896455e610d15d4eaa5
- SHA1 22180374f927b9132c3963caff9c1f28155010c3
- SHA512 e0ac562a8eee4ac0d816ff107793176bfe00d6a91900f6f8ec1a7c9933b2078914d8b722da51cacdd40b31030537f57298e1a5d9121b6807b8acc43b736f75e5
- SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDuKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwReXEn8mb
- TLSH T11AE6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1788 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330756235198884" chrome.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 5060 chrome.exe 5060 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1960 4436 chrome.exe 87 PID 4436 wrote to memory of 3648 4436 chrome.exe 89 PID 4436 wrote to memory of 3648 4436 chrome.exe 89 PID 4436 wrote to memory of 1788 4436 chrome.exe 90 PID 4436 wrote to memory of 548 4436 chrome.exe 92 PID 4436 wrote to memory of 548 4436 chrome.exe 92 PID 4436 wrote to memory of 4688 4436 chrome.exe 93 PID 4436 wrote to memory of 4692 4436 chrome.exe 94 PID 4436 wrote to memory of 4688 4436 chrome.exe 93 PID 4436 wrote to memory of 4692 4436 chrome.exe 94 PID 4436 wrote to memory of 3768 4436 chrome.exe 95 PID 4436 wrote to memory of 3768 4436 chrome.exe 95 PID 4436 wrote to memory of 1300 4436 chrome.exe 100 PID 4436 wrote to memory of 3220 4436 chrome.exe 103 PID 4436 wrote to memory of 1268 4436 chrome.exe 104 PID 4436 wrote to memory of 332 4436 chrome.exe 105 PID 4436 wrote to memory of 5060 4436 chrome.exe 107 PID 4436 wrote to memory of 3464 4436 chrome.exe 108 PID 4436 wrote to memory of 3464 4436 chrome.exe 108
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4151c728,0x7ffa4151c734,0x7ffa4151c7402⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,9983599166186228407,8398674862854413771,262144 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:22⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,12541348287157219670,1374044139463080138,524288 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:32⤵
- System Time Discovery
PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,1766651298474397451,7547423219861073334,524288 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:82⤵PID:548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,3612561970169395643,14457343495250691085,2097152 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,9052316662423769477,81839838981275092,2097152 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4388,i,9868897524207441042,13325146404793409925,2097152 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3968 /prefetch:22⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,4092513349277002403,4490678941535161946,524288 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:82⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,18432331218676432520,9980438934440044165,524288 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4816 /prefetch:82⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,13900586826999720342,13828401639451392882,524288 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4844 /prefetch:82⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,188513617418620799,3637918938931795107,524288 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:82⤵PID:332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4428,i,15053232598122602708,6774071103326496756,262144 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4960 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,6936890588298477423,6645200304802087387,524288 --field-trial-handle=1948,i,12428189294538639646,13282322251810977363,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:82⤵PID:3464
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 836f24d4ce013de1190f7b58835bb5112b5cd74e1219c80d8e6b4977cefde390
- MD5 7d82ea79c751698b1accd0c5c66969a1
- SHA1 0c589caae52fe83bb60827cc4c52e7f037586856
- SHA512 81cf883be0b022a3cc192d34563914b8443525a04b27896393dcd7b1a0e2d74d5f7a28cf876eeb3d1a40fb920b156b26ff8b992137213bedcbc5e15554dd316c
- TLSH T107E02B65C872EC3B18F90728A0111741D75513DB2A40C94F7A3C901D8FB2A374585D6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 ddb673bed12986d49ff18a72cbbeb192b88607319cd1ba31a82a3593d7fdb3d8
- MD5 d5a64ef8e60bc70875afd7cc8458c8aa
- SHA1 aa71df5e4f2c998af776ac69fad9836a380023d2
- SHA512 8fd444df209ae6bd48e5e677cfdf7390dafbabca567b447be45573a36456e7d921dd6028b4777319a33445999fd2a7804fafe76e7cd1a71933b22aed9a63f123
- TLSH T15C419DF793B495BE8A1192F4EA156E1FCE6A0524031C3CA689D4AE2B53F2972D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 f5bafc59fe10e91b204ab2798e02ed5d8ba4ee6f56aa41c1ec0d205379267951
- MD5 65eb63fbb5470e76e2380e94c1c418d7
- SHA1 f8157eb5c6f585eb1cd83412cc47456c13c999ec
- SHA512 a9ea244333a4030a269958c32976e5bd99c67a6ee584e3234eebaaa62e52f5823dc7ed726db1382723f2e286eb46d0f4ec71edc77376da1cc5d5faefa9856cff
- TLSH T16141C0F783B4957E8A1196F4EB156F1FCE690524032C3CA688D4AE2B93F2872D14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 519B
- SHA256 3ca55fdc76c8cbc2788f539bd95cf227bd756ffdd814c7946bab4bc45188eb16
- MD5 695bce552a75f24252f2079cae124b4c
- SHA1 5405137bd9cc7b24baa186fc72b5031319af9399
- SHA512 4340165535532ae4726430c927b191c2fc60a19565c87a3b9674b8d5559d67a2a55529b6314f166cdbc4132db0aefefb0ecfcdbbe2090d3b5c72bf0c071e1dfd
- TLSH T12DF0C077E27E301750B901B74D047C0D25B2AC35028258E0CEBB823EE0860E70B13847
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 dbcf8e57ed3e62a79d8d69108905c2d19bdcd54b29d46c6e076afd7eaefe2103
- MD5 104526c7c5ded0c804ff73ace16196fd
- SHA1 61f8f8a12243c665e8d994919f793885b8104591
- SHA512 09a7049ed7ae935704b3d07f84f6ce060a6e6436529c7f444b70c2478dec1853c8cf91c6693bf5ddbd8282a716b75b2d93ef6f7e73fb8a98f445b4da3bcea77c
- SSDEEP 192:IRXvuQM5uv70ppPRp9dfq9+Hsb+WNnY3P8Z42nMkwiVyIsnAUgE:IRXv4KgHX68wmP8i2MCE
- TLSH T11852B62ABA006D3B9DDED269F9527F53D3F5202225911E84E7FC8A2C19E75CC222705B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7699b6008df2e25c4cebacc5ccc75753fd4ebff3ba2a441be079a89da20995f0
- MD5 e5678323fb180e9118cb120396221dbb
- SHA1 b34b74f65b131813ac3a5a1f25abf6d5863deba6
- SHA512 5227ebbfcf875155f1b5439c8ba88714bd54aaa9d495aba32440cee98c230aea334dec705b91787b6220f955344b4cd11d9ac7973e0c384fa48a3e4487b0e778
- SSDEEP 192:IRXvkQM5uv70pAPRp2dfq9+Hsb+WNnY3Pr42nMkwKVyIsnAUge:IRXvWKgUXX8wmPk2Mqe
- TLSH T1FA42C62DAE006D3B9DDEC229FE527B53D7F6202125911E84E7FC8A2C19E75CC222705B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
- MD5 3db4d2ed90c53237037f403d9b6c10cf
- SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
- SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
- SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
- TLSH T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 4dbe12973aba61095710ca957685b0dd5f3c563df9cbf1c9bd64eb440e99ddb6
- MD5 c86ffa262bef2c3ba54e52aec325ec0b
- SHA1 640331e6efed7b292c9cbc9ec1a1f967f1e50677
- SHA512 9e4e079894a577cf7bbcc804291080dd1483a34033c5968d5895c0d7a614ac7ff92b782d50497f9bd813170a7d3f3ad515b750f9eaee5b1af05320a016b5e168
- TLSH T138B0124090025115C60A03F4914214CC71249F60AA0B170143E4AD338826750C118061
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5897b7.TMP
- Size 96B
- SHA256 1bec39472460ec56933f495b002c97ff12b8ad584f22d60b9bc313b2f205a6a8
- MD5 18164f5beeb94f9950323b403654ce25
- SHA1 22af3df374b588111612533c26810bb81ac28b4e
- SHA512 a35d1cdf0c01d4868431b5ec47795bdef51a09d8c4c3a699167291850c9b2ff88c9b6c30cd774504847db3a81624f63ac47c7fdfee935f5d58eb003c28018f14
- TLSH T16FB02200C00223B2C00203B02A80E0E8F020CF20C303020283F00ABAFC382B00228030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 117KB
- SHA256 43a39fc6c76ca35978257eb00ae3a85ff9cd43375e2415a05bbba48495cf60a7
- MD5 2c611a23b492d212cf1041637be662e6
- SHA1 b37f4a6b086a9586437c1fefb3550bcff1a2dba7
- SHA512 5bc20b5ed27c28aa66b97bb6d06cb70e56b3c2f23b8092664b199d45c865e6f465b5e98877ce27ca7861f9f7bc676a6a3447ecf999aa77f9601c118a5e6878da
- SSDEEP 1536:B14yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:H6qfd7NtZL8cHQRZEQ6Sps3
- TLSH T16DC30237EBC21E339ED2DB64B5130F9793B644A9D034C301AE6D3BBB6893455A48249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 582ce1901d4fd4f1d2f6a56f227bd76ddebb8f3043806972a68bda045fa667b0
- MD5 0b25e1f5763b618efa2360a18fe979f1
- SHA1 3b5b1f2a93e7d5df436089ff8810dfe2e17f7493
- SHA512 729ce0f612d9c3233ecf5ed9c2071d51b7a961f417c5e48f75747d1add7e9df5260de9bb3f069b521d0bdf4ed0113807eb5695b3f7fb3cff97a96a997f466de5
- SSDEEP 1536:l14yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:76qfd7NtZL8cHQRZEQ6Sps3
- TLSH T1DBC30237EBC21E335ED2DB60B5130F9693F644AAD034D301AE6D3BBB6893595A44249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 dd43b1ccae1639486c45ff91e001cf55d4742e3b630f3170bf288cd536273e4c
- MD5 3bdd2fec72e6e070ff0469222515c05c
- SHA1 5a0d6dbff6e649a0f110e835c31dc2e5b6d2da57
- SHA512 9bb5c1bd28ac0d4d05eb188b4baee0347bf29b79c6e757f4ca88b6f04d13349c1aedc847849e263fb6108ab685e3560e7d1206db8f9b72a4ed8bbb5cf2c63b06
- SSDEEP 1536:bcLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Yqfd7NtZL8cHQRZEQ6Sps3
- TLSH T15AC30237EBC21F379E92CB64B9130FD697B644A99030D301AAAD37FB7C93591684249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d869bfbd93392f9601478c28c8945258fb71781fe4d3a90fd7d98196ed643114
- MD5 3a31e506b16dc9dcec6c9ab2ec96270a
- SHA1 17b7454df69ed5beab1f5a7fa5defbf3d8902fd7
- SHA512 f62751c2003e0f1ab4a2710097e3eb416dc3a79df729d518deb526ffcd2c07a3517200198a7b4be0991eb7d50d4f1c0c2b810ffe2d0225ddbae6d07183f8c81a
- SSDEEP 1536:WoAyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:rCqfd7NtZL8cHQRZEQ6Sps3
- TLSH T1B3C30237EBC21E339E93CB74B5130FD797B644A99034D301AAAD37BB6C93591644249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 732e9a92b37360abca3645ed8dece8183fb6cd204489754a660d7eea3cb74c7e
- MD5 ba5a975b47462c86c9f845b35935411d
- SHA1 d58ba8a0d8980aa290e6427d37e24ea8802fd73f
- SHA512 931d35396e844c79ca4a76fa36709479d050ea21f566329adf2e134bc2477b9ed0bbcefcfa9696fb9498ef198cbc40a5fbdb36503df1697faac7828f261a39d7
- SSDEEP 1536:loAyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:OCqfd7NtZL8cHQRZEQ6Sps3
- TLSH T166C30237EBC21E339E93CB74B5130FD797B644A99034D301AAAD37BB6C93591684249C
- MD5 SHA1 SHA512 SSDEEP TLSH