Overview
overview
7Static
static
3Zuhls Macr....0.exe
windows10-ltsc_2021-x64
7$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDIR/UAC.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ll.dll
windows10-ltsc_2021-x64
3LICENSES.c...m.html
windows10-ltsc_2021-x64
3Zuhls Macro.exe
windows10-ltsc_2021-x64
7d3dcompiler_47.dll
windows10-ltsc_2021-x64
1ffmpeg.dll
windows10-ltsc_2021-x64
1libEGL.dll
windows10-ltsc_2021-x64
1libGLESv2.dll
windows10-ltsc_2021-x64
1resources/app.js
windows10-ltsc_2021-x64
3resources/elevate.exe
windows10-ltsc_2021-x64
3vk_swiftshader.dll
windows10-ltsc_2021-x64
1vulkan-1.dll
windows10-ltsc_2021-x64
1$PLUGINSDI...gs.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ec.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...7z.dll
windows10-ltsc_2021-x64
3$R0/Uninst...ro.exe
windows10-ltsc_2021-x64
7$PLUGINSDI...ls.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
3$PLUGINSDIR/UAC.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ll.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...gs.dll
windows10-ltsc_2021-x64
3$PLUGINSDI...ec.dll
windows10-ltsc_2021-x64
3Analysis
- max time kernel
149s - max time network
163s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
02/10/2026, 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Zuhls Macro Setup 2.0.0.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/UAC.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
Zuhls Macro.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
d3dcompiler_47.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
ffmpeg.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
libEGL.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
libGLESv2.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/app.js
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
resources/elevate.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
vk_swiftshader.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
vulkan-1.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
$R0/Uninstall Zuhls Macro.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
10 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/UAC.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 8.8MB
- Sample261002-tcnegade65
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- MD5 2675b30d524b6c79b6cee41af86fc619
- SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
- TLSH T17B96A52F7F48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4448 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 2964 chrome.exe 2964 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe Token: SeShutdownPrivilege 4232 chrome.exe Token: SeCreatePagefilePrivilege 4232 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe 4232 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4232 wrote to memory of 3336 4232 chrome.exe 84 PID 4232 wrote to memory of 2036 4232 chrome.exe 85 PID 4232 wrote to memory of 2036 4232 chrome.exe 85 PID 4232 wrote to memory of 4448 4232 chrome.exe 86 PID 4232 wrote to memory of 3972 4232 chrome.exe 87 PID 4232 wrote to memory of 3972 4232 chrome.exe 87 PID 4232 wrote to memory of 3856 4232 chrome.exe 89 PID 4232 wrote to memory of 1768 4232 chrome.exe 90 PID 4232 wrote to memory of 3856 4232 chrome.exe 89 PID 4232 wrote to memory of 1768 4232 chrome.exe 90 PID 4232 wrote to memory of 4824 4232 chrome.exe 91 PID 4232 wrote to memory of 4824 4232 chrome.exe 91 PID 4232 wrote to memory of 3556 4232 chrome.exe 97 PID 4232 wrote to memory of 3680 4232 chrome.exe 102 PID 4232 wrote to memory of 3956 4232 chrome.exe 103 PID 4232 wrote to memory of 2928 4232 chrome.exe 104 PID 4232 wrote to memory of 2964 4232 chrome.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd6ce3c728,0x7ffd6ce3c734,0x7ffd6ce3c7402⤵PID:3336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,1008261719195177885,11994618925850288297,262144 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,5037476175134548614,11500147022120447486,524288 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2244 /prefetch:32⤵
- System Time Discovery
PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,13217153085130661564,16919371517635419133,524288 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2564 /prefetch:82⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,4502442499725426234,1300552756781080086,2097152 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,2044761269425728176,12585386155162772308,2097152 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,17280087894844622754,1477896916949034486,2097152 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4404 /prefetch:22⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,14072033105782148900,13138783093627283470,524288 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5232 /prefetch:82⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5280,i,7123052776738820806,11675025207740626146,524288 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5256 /prefetch:82⤵PID:3680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,15683381129821237270,1788779206968905166,524288 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,3006602600670514036,10399486354803904753,524288 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5400 /prefetch:82⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5596,i,1263685629855546514,16864962187590103491,262144 --field-trial-handle=2076,i,4705421432815318538,1367137615015917793,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5352 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2964
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0f8472aa-17ce-4102-b177-bed815c4733c.tmp
- Size 132KB
- SHA256 fe2cc1eebc2622be027b098745594ec3ab4508fdc68f59f2dccbe10f130aec44
- MD5 e2d31a9df4b30707e5d7c4b88e2103df
- SHA1 a7e611cc398079dba886f23fd78b83cd9539811d
- SHA512 06c92ec65470009ba67df141bebbd56dfc12ac4650f532dad99c786a0173b52e582fa0ee1635953befd744c6b34a80cf3691be4f2f3ba4c78803100a53001a23
- SSDEEP 3072:vIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:XPtbmf1K49XLWbEPi4NTKlLz8
- TLSH T11AD302617D01BCB4A9EFDB22A1902A169AF8D94B953D7BE61CDE3F4C05A3699C304C13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1fa79c91-7dee-4fa0-bc0f-f85d3d137586.tmp
- Size 132KB
- SHA256 797a344e1cb8853857140010fc3ac7958e61182d051f8ef0ce9532cdb9bdf6cc
- MD5 88102a15dee063a81fdcd04760e0dd3b
- SHA1 b79b7aaf451ab67dff33ed870b9427ef8e8905e2
- SHA512 b221717539cb3e780137864c13013a0c721867f71abec27fb20aeff285663e7d4298f0988e134d8934d733b14fb400209b920ee8a40d7d23e87b6f623f478654
- SSDEEP 3072:RkIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:RAPtbmf1K49XLWbEPi4NTKlLz8
- TLSH T126D312617D01BCB8A9EEDB21A1502E169AB8C94F953D3BE55CDE3F8C05A3ADDC304853
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\21de33b8-3e07-43d7-8c79-d3c613982bde.tmp
- Size 132KB
- SHA256 abcab6513fd2281b4a8625d83103323eb230fb67adfd5f3b996d28629804a588
- MD5 ab73cf9b73d3465ad79a33f1a3e04254
- SHA1 0191fee0f7eb78701b4d0a0ee46a274fed7ce7c4
- SHA512 b857a6c358e663360ca353b108e076d78f433c8579325b20cddfeaf77071bdb39bc226af16885560c908065b504fe0487349f9af7087c8feeb8c578b2794570b
- SSDEEP 3072:WIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:WPtbmf1K49XLWbEPi4NTKlLz8
- TLSH T10BD302617D01BCB4A9EFDB32A1902A169AF8D94B953D7BE61CDE3F4C05A3699C304C13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2af08f19-16b0-4f04-8ccd-0e9de3408df7.tmp
- Size 131KB
- SHA256 3b49e88a51a3a20cf3c61402c58ccadc5547c8a193a995eea53c011b10a27df1
- MD5 388a9fb675dbb238a0a5bbb71c435407
- SHA1 efde7a1da6f1cb6889a4f17cebfd8d75ccafd5f0
- SHA512 28222aac6b246402b8b5c6185787dbf851afd7ff6fb3ae4889dd18cf5876bebcd6d971f12ed5bbbc103912d4c616b8f9bb8cf728a8c21dc9ab5bc922cc97edff
- SSDEEP 3072:lIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz8:BPtbmf1K49XLWbEPi4NTKlLz8
- TLSH T143D312217D01BCB8E9EFDB22A1905E15AAB8C94B95397BE61CDE3F4C05A36D9C304C13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\45fdb2a7-dc6e-4d2d-8a9f-9065e42ea41b.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a9d30f7-dc89-47bf-a8cf-74dbb6eb50f4.tmp
- Size 649B
- SHA256 e1820f6e688b3d8187b26ff96ecc511d386afb2a3d89a835c50425b17a2fff69
- MD5 ffc073e22f93ef034b64250fd3c9b194
- SHA1 0a21d9e182d4a3e9bc60df74098a8190292beb6f
- SHA512 d0b14d5548d57437fa9d8e2f4125c2116d6984853167cd8a1464ff04982b2f442a6be1d6921753334d1d97fcbc5b4f61272c38ad10dec757c969fe6990eec645
- TLSH T125F0F4A9DD21AC372CFD1B2960A54F46E750135F3640595B3A3D910D8FB1A3B468681C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7814f99c-32f1-4f6c-ae14-0913d2e69347.tmp
- Size 12KB
- SHA256 96dcb7043840dbca804d61753dbb72a602ac5f5746a6ac1d167fa5b32dbdc899
- MD5 cf8a3c123a94cf25fdd656d0f44d37f9
- SHA1 681c00debfb97004876927a147ae0d25fddd0241
- SHA512 ca0ff8b60180ba549e79b4412425453e2688c7296d1e84a4dfd09bc93b75fcd9608e95017167280181b2b52c4457554b99434d8d4cbcac3e2973acfb6317262c
- SSDEEP 192:VRhbUoRXVkziv7TpAPRp2WX9AHsb+WNnqiPE6eksVyIsnAUge:VRhbU8gufUXnWw/PAe
- TLSH T1AC42962DAD10797B5DDBD22AEA257F93D6F5112130D42E84EAFC897C20E76CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\81abc74f-2d43-48ce-9efe-761b04e897f7.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\994a2f6d-9470-462b-83cf-2ef033f3bdaa.tmp
- Size 2KB
- SHA256 48ec67326e06e3de43ac97c220331e34d6e883b14d90789456166e32d3214b02
- MD5 0f829a7115de06fdbafa642d978cc740
- SHA1 78ab0399cad1d303bed34a8b4fef61b1bba18490
- SHA512 de8117053ed7dcefe1e7219e5cb63ebb28a069c296af57f372f51a9f5cd4373e9b13e130f83187366223998f82281094e086696d5304ab502d4b644d7e143ac9
- TLSH T1A2518DF7C3E8867EC91156F8AB152E1FCE290A14532D3C56C8D8AE1F53E28B1D24065F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 39feb1f5a4c0b8261d5e0e94e1a5dea2e030f094c2e37ea7df6ede840344038e
- MD5 073470958ff791e321f54378ddb6b53e
- SHA1 298e58a219fa728b2c5e03f1d08d01db33d73cb2
- SHA512 82c2747b443bbd4e2f73d518f4ba2742e5be6da78635e7bc4721011c324cb03be196a18083051bdcb94889ecf12dcdba8151e0b1d2afcedab434481f11eb1e5a
- TLSH T137B0126C80426321C08202F4166524883154EF14A715130152F00E41D835261C15B068
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 179e88a62732001a26f7835b6af3d2c5090d3c55fc2ccaffbaad372ffd9b1589
- MD5 8ec5f7088b8b4a8b1056dac45a172e28
- SHA1 a7fdb2779e3e10f3261a32302b2e2c869727b446
- SHA512 c19fd111ea259105e1c59ca43338d32b6fdba292b2fbe4a74886512135734ae0ea2570478bd451f1eeefe76ec7f4e304b04a3a54829416bca22c476ccf5dc398
- TLSH T1C4B00259D1027222C44623F229D9A5ECB260DF35C613121792E01BA7EC75B608A67D60
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d75531ff-680b-4637-879c-98f42266a1af.tmp
- Size 17KB
- SHA256 825e6b89b8469681ab3913d31f35e2ef225e4dc5513297f72a50a392fcb57654
- MD5 381c0b6ed66f344b880d905ce8ed5536
- SHA1 4bf16119542a559354423ca283da00c408af0cbc
- SHA512 1942b61c7e8514242bd139c01e1f9d56d625532940645354120c75465ef401add71389162894b545533493ca83a1253affaca918791848f7e83a4dc824d8bd90
- SSDEEP 384:wqjcv7KxkXqKf/pUZNCgVLH2HfgslDj7pLuLceSa7XODcz+ErU3JaHGuC4JVLkLW:w6cv7KxkXqKf/pUZNCgVLH2Hfgsxj7ps
- TLSH T1CD7208676C489A370F94DACCDC17BE4FACB9015B61ED886443FA982603D5BDF110A2E7
- MD5 SHA1 SHA512 SSDEEP TLSH