Overview

overview

7

Static

static

3

RiftManager.exe

windows10-2004-x64

7

RiftManager.exe

windows11-ltsc_2024-x64

7

ms-playwri...47.dll

windows10-2004-x64

1

ms-playwri...me.dll

windows10-2004-x64

7

ms-playwri...me.exe

windows10-2004-x64

7

ms-playwri...lf.dll

windows10-2004-x64

1

ms-playwri...xy.exe

windows10-2004-x64

3

ms-playwri...er.exe

windows10-2004-x64

1

ms-playwri...er.dll

windows10-2004-x64

1

ms-playwri...ce.exe

windows10-2004-x64

1

ms-playwri...ce.exe

windows10-2004-x64

1

ms-playwri...er.dll

windows10-2004-x64

1

ms-playwri...GL.dll

windows10-2004-x64

1

ms-playwri...v2.dll

windows10-2004-x64

1

ms-playwri...er.exe

windows10-2004-x64

1

ms-playwri...er.dll

windows10-2004-x64

1

ms-playwri...-1.dll

windows10-2004-x64

1

ms-playwri...ll.exe

windows10-2004-x64

7

ms-playwri...GL.dll

windows10-2004-x64

1

ms-playwri...v2.dll

windows10-2004-x64

1

ms-playwri...ain.js

windows10-2004-x64

3

ms-playwri...ain.js

windows11-ltsc_2024-x64

3

ms-playwri...er.dll

windows10-2004-x64

1

ms-playwri...-1.dll

windows10-2004-x64

1

ms-playwri...64.exe

windows10-2004-x64

1

ms-playwri...64.exe

windows11-ltsc_2024-x64

1

ms-playwri...ps.exe

windows10-2004-x64

1

ms-playwri...ps.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/10/2026, 15:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ms-playwright/chromium_headless_shell-1179/chrome-win/headless_shell.exe
  • Size 168.4MB
  • Sample261022-sqrtdaaf49
  • SHA256 41436563cbf1efa45c408bd5c0abea94b36f32220ac98521426ad190001a0e3c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ms-playwright\chromium_headless_shell-1179\chrome-win\headless_shell.exe
    "C:\Users\Admin\AppData\Local\Temp\ms-playwright\chromium_headless_shell-1179\chrome-win\headless_shell.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Users\Admin\AppData\Local\Temp\ms-playwright\chromium_headless_shell-1179\chrome-win\headless_shell.exe
      "C:\Users\Admin\AppData\Local\Temp\ms-playwright\chromium_headless_shell-1179\chrome-win\headless_shell.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless=old --field-trial-handle=1368,i,9446895867401907940,2783544707053393629,262144 --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=1460 --mojo-platform-channel-handle=1456 /prefetch:3
      2⤵
      • Reads the TCP/IP host and domain name from the registry
      PID:4204
    • C:\Users\Admin\AppData\Local\Temp\ms-playwright\chromium_headless_shell-1179\chrome-win\headless_shell.exe
      "C:\Users\Admin\AppData\Local\Temp\ms-playwright\chromium_headless_shell-1179\chrome-win\headless_shell.exe" --type=gpu-process --headless=old --use-angle=swiftshader-webgl --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --field-trial-handle=1368,i,9446895867401907940,2783544707053393629,262144 --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=1352 --mojo-platform-channel-handle=1028 /prefetch:2
      2⤵
        PID:3148
      • C:\Users\Admin\AppData\Local\Temp\ms-playwright\chromium_headless_shell-1179\chrome-win\headless_shell.exe
        "C:\Users\Admin\AppData\Local\Temp\ms-playwright\chromium_headless_shell-1179\chrome-win\headless_shell.exe" --type=renderer --headless=old --allow-pre-commit-input --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1792683476976481 --launch-time-ticks=612833021 --field-trial-handle=1368,i,9446895867401907940,2783544707053393629,262144 --disable-features=PaintHolding --variations-seed-version --enable-logging=handle --log-file=1624 --mojo-platform-channel-handle=1620 /prefetch:1
        2⤵
        • Checks computer location settings
        PID:560

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads