Overview
overview
7Static
static
1GoogleOneO....0.zip
windows10-2004-x64
1GoogleOneO....0.zip
windows11-ltsc_2024-x64
1GoogleOneO...DME.md
windows10-2004-x64
3GoogleOneO...DME.md
windows11-ltsc_2024-x64
3GoogleOneO.../bg.js
windows10-2004-x64
3GoogleOneO.../bg.js
windows11-ltsc_2024-x64
3GoogleOneO...mon.js
windows10-2004-x64
3GoogleOneO...mon.js
windows11-ltsc_2024-x64
3GoogleOneO...ver.js
windows10-2004-x64
3GoogleOneO...ver.js
windows11-ltsc_2024-x64
3GoogleOneO...ud.css
windows10-2004-x64
7GoogleOneO...ud.css
windows11-ltsc_2024-x64
3GoogleOneO...hud.js
windows10-2004-x64
3GoogleOneO...hud.js
windows11-ltsc_2024-x64
3GoogleOneO...lay.js
windows10-2004-x64
3GoogleOneO...lay.js
windows11-ltsc_2024-x64
3GoogleOneO...ook.js
windows10-2004-x64
3GoogleOneO...ook.js
windows11-ltsc_2024-x64
3GoogleOneO...t.json
windows10-2004-x64
3GoogleOneO...t.json
windows11-ltsc_2024-x64
3GoogleOneO...up.css
windows10-2004-x64
7GoogleOneO...up.css
windows11-ltsc_2024-x64
3GoogleOneO...p.html
windows10-2004-x64
3GoogleOneO...p.html
windows11-ltsc_2024-x64
3GoogleOneO...pup.js
windows10-2004-x64
3GoogleOneO...pup.js
windows11-ltsc_2024-x64
3GoogleOneO...��.txt
windows10-2004-x64
1GoogleOneO...��.txt
windows11-ltsc_2024-x64
1GoogleOneO...��.bat
windows10-2004-x64
3GoogleOneO...��.bat
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
GoogleOneOfferRunner-v1.1.0.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
GoogleOneOfferRunner-v1.1.0.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
GoogleOneOfferRunner/README.md
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
GoogleOneOfferRunner/README.md
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
GoogleOneOfferRunner/bg.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
GoogleOneOfferRunner/bg.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
GoogleOneOfferRunner/content/common.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
GoogleOneOfferRunner/content/common.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
GoogleOneOfferRunner/content/driver.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
GoogleOneOfferRunner/content/driver.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
GoogleOneOfferRunner/content/hud.css
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
GoogleOneOfferRunner/content/hud.css
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
GoogleOneOfferRunner/content/hud.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
GoogleOneOfferRunner/content/hud.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
GoogleOneOfferRunner/content/play.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
GoogleOneOfferRunner/content/play.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
GoogleOneOfferRunner/inject/hook.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
GoogleOneOfferRunner/inject/hook.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
GoogleOneOfferRunner/manifest.json
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
GoogleOneOfferRunner/manifest.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
GoogleOneOfferRunner/popup/popup.css
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
GoogleOneOfferRunner/popup/popup.css
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
GoogleOneOfferRunner/popup/popup.html
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral24
Sample
GoogleOneOfferRunner/popup/popup.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral25
Sample
GoogleOneOfferRunner/popup/popup.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
GoogleOneOfferRunner/popup/popup.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
GoogleOneOfferRunner/安装说明（Windows）.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
GoogleOneOfferRunner/安装说明（Windows）.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
GoogleOneOfferRunner/检查安装.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
GoogleOneOfferRunner/检查安装.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target GoogleOneOfferRunner/popup/popup.html
- Size 4KB
- Sample261104-x52pcaee63
- SHA256 fd05fb0d7066cdef9e98df1f13480fdee1cdcdc0795267428805d8bc1960043e
- MD5 f3a2a621e843546a5807b8c1aec8992b
- SHA1 075c75006c13567ad28d164475abb25b1210d432
- SHA512 e505e92f473f1c6e5a86c92bcf0c153b947c029134634795375ba832ff360cd2c81d4a8965ce8f25c65e215011f58e7b441fbd284d13358ff069abbcd54fe283
- SSDEEP 96:95iEsmxc48b4V1Mw9MEEjOHpyH90vN+0qepa9fGe1hr:aEsYD8b4VkmYGihr
- TLSH T1E6A127B1A0F95A77822380C7A59357263ED09513D5AA5200F1FD1FE01FEBD52AE0F52D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5024 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 5664 chrome.exe 5664 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe Token: SeShutdownPrivilege 3396 chrome.exe Token: SeCreatePagefilePrivilege 3396 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe 3396 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3396 wrote to memory of 2920 3396 chrome.exe 89 PID 3396 wrote to memory of 5312 3396 chrome.exe 90 PID 3396 wrote to memory of 5312 3396 chrome.exe 90 PID 3396 wrote to memory of 5024 3396 chrome.exe 91 PID 3396 wrote to memory of 4604 3396 chrome.exe 92 PID 3396 wrote to memory of 4604 3396 chrome.exe 92 PID 3396 wrote to memory of 5736 3396 chrome.exe 94 PID 3396 wrote to memory of 5188 3396 chrome.exe 95 PID 3396 wrote to memory of 5736 3396 chrome.exe 94 PID 3396 wrote to memory of 5188 3396 chrome.exe 95 PID 3396 wrote to memory of 6032 3396 chrome.exe 96 PID 3396 wrote to memory of 6032 3396 chrome.exe 96 PID 3396 wrote to memory of 2452 3396 chrome.exe 100 PID 3396 wrote to memory of 2364 3396 chrome.exe 110 PID 3396 wrote to memory of 4708 3396 chrome.exe 111 PID 3396 wrote to memory of 2904 3396 chrome.exe 112 PID 3396 wrote to memory of 5664 3396 chrome.exe 114
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\GoogleOneOfferRunner\popup\popup.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcbdaec728,0x7ffcbdaec734,0x7ffcbdaec7402⤵PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,3033487239630508293,10067554403598456175,262144 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1888 /prefetch:22⤵PID:5312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,11562695665827534872,14850627925817352539,524288 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2232 /prefetch:32⤵
- System Time Discovery
PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,15567001035750884266,7981780714795097681,524288 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1244 /prefetch:82⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,3071485835404674488,512289134850642860,2097152 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:5736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,15066032879064335829,15487977570578394849,2097152 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,12488751206178120752,5297002822016118973,2097152 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4152 /prefetch:22⤵PID:6032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,10926819171184223256,4903992586505863706,524288 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5228 /prefetch:82⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,10762910634869846168,3018935845500498151,524288 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5632,i,8098085576113278002,6862047491752581612,524288 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5588 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,2091991276967376896,5016242967148142235,524288 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5436 /prefetch:82⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4548,i,6106372378770925680,8412132936764182839,262144 --field-trial-handle=1892,i,17861398237748918898,14809973000992746614,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5664
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:564
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\03eabc4e-5592-4716-af24-e3b72574c111.tmp
- Size 130KB
- SHA256 9bc9bf0b359dc03bd3e552f7b2dab411a5d32bc14aa68c75813bac2362de0615
- MD5 a234474bcb9d77c3c3df0e0577ba6332
- SHA1 c9ce5199c53a32da1bc36b196d9f2982221fe43a
- SHA512 78415e94e77574db1ed1d40e6c289764951211c5128f10f5470c694534a8b68f15b1692b9a35adac3d1e4e2b62b855dce4cd6f5b44d0df02bebfebaa475f3160
- SSDEEP 3072:Z+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:Z+hFD+7t56OD9ZfSAppry
- TLSH T1E2D31232AA91C8BBC9BC6541B297A304DE766CED41DE3A09444A5F8EE05FD4C0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0b97ceba-3f64-48de-abbd-9d4755ec0b4c.tmp
- Size 131KB
- SHA256 8f6086cf96d5b761cdffaf4b76e9c8e9b6ace0a8c3555352a0e383e7168ae5b0
- MD5 da2d009fe7f93aff96c48d3c4f43953e
- SHA1 bd2a78b61d42ceb5f23bcfcbf92beacb51ea3e37
- SHA512 70c7e17285d00b8736a013df9db5e3120d72a7419d841ae04dd1a3c5882bc70d02672614bc4dd6ff324c9681bdddebb8b2bb177a4a545dc8743ad37c9afe0a34
- SSDEEP 3072:Q+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:Q+hFD+7t56OD9ZfSAppry
- TLSH T179D31232AA91D8BB89FC7541F147A304DD666CED41DE3A09844A9F8ED09F94C07B3A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\23a4b09f-d919-4a8c-bf6a-06c964b25bb1.tmp
- Size 131KB
- SHA256 34d98ec4f53da70ec27b1a992ea1f839be4965832f5c3c5bb58c65a2f9c648b0
- MD5 e405ed97f974e081a0f26a4ef3c528f0
- SHA1 1456335ad6ac46c5c0b328fa00a727cd26d1f06e
- SHA512 8780eba038725d1c2c481b7a4d62995d1525df0b5ddefefaa930aaf0cd22c9b2c52679ee251868bc30f535d07c51b38a1a7a5337e7a56f103587ccf10db39765
- SSDEEP 3072:A+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:A+hFD+7t56OD9ZfSAppry
- TLSH T116D31232AA95D8BB89FC6541F147A304DD66ACED42DE3A09444A5F8ED09FD4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2c23c2e7-f361-44b3-8bb8-db67e97d7dee.tmp
- Size 131KB
- SHA256 2ccae1040ad7577dd1fdca8e968cd10e564efc52595d57f95fb108db9910b1ce
- MD5 37ededb086594fd5b5cff82bced5ca20
- SHA1 7e8af3b7393e7c9e3c1cf143ce0e39f411b2efdb
- SHA512 73ea6a4503975d4c66772403018c7fd8b1c261d0af62e5595a17d73b499e8923d4b2e93ee78ea55507dda3f47ce15b9864abae32e8600d9de53200be80d5cbf0
- SSDEEP 3072:N+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:N+hFD+7t56OD9ZfSAppry
- TLSH T1BBD31232AA95D8BB89FC6541F147A304CD666CED42DE3A09444A5F8ED09FD4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2a3b7493-f81b-4bca-b4ad-82858d728990.tmp
- Size 12KB
- SHA256 85889737d2163e3c71eace05600b10f7e9454c4ba9e80294c20bb0d83ddde8a0
- MD5 89b88bada25d69f2b515f171c3e10bbd
- SHA1 e1794ac67c4ebbff8984b5c6a6343aea1bd7965b
- SHA512 c8c34b4b44331461c404eade7532c7ebff7d12b52fbacd35ff99294493916ed6b328a03ccc28abf46080845eb964507800fc3fb88b808603a41092fe9a8d6ed2
- SSDEEP 192:kR5reST9qZpYmHVu1v78pAPRp2Xu9THsb+WNnXOPe8kgEXatfZ+VyIsnAUge:kR5reSTwo3F4UXtJw+PeVgoaP2e
- TLSH T15442A529AD50743B5CDFD22AFA66B767DBF9102120D42E84E6FC893C25E75CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\82ce8e1f-f0e4-4f49-98dc-839b65c3626b.tmp
- Size 17KB
- SHA256 a55c9d9bfbff27f4080d00af8282862be9cc6b021b0d1cf3b654e6d1857a1705
- MD5 c8926c13ed1e541a9ebca052800d518d
- SHA1 3522a9925410a3faf9a73cb924c1c1fb4dbffb5b
- SHA512 0cc7f70f08f90753f1713955142d2f28c2b7b8284eb83bb86dea581036af8c57e30edda3af83eb81e1295de946e3c6812dc7f1671fca9c13e29cb035d90943a4
- SSDEEP 384:j5j3S7KxkXqKf/pUZNCgVLH2HfgslA/7pLuLceS9YXOD32+ErU3tJHGT7LAE:jJ3S7KxkXqKf/pUZNCgVLH2HfgsC/7pO
- TLSH T1E772FA67BC4C9A3B4F94C68CDC267F4FADB5024B61ED886443FA582603D5ACB05062FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\90b2830f-253f-45b2-8efa-04573c4ebaa3.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\54dd488e-e28e-4867-902f-4802b9008892.tmp
- Size 1KB
- SHA256 e2e504b37788c9d75db8bed18a6425de3d76d178b9457a1df025e7d99e75343a
- MD5 f8cc4111f79d6710bfdfc56ced254d4a
- SHA1 0ff903d8e9550b6310048d9dabf794f65ef50619
- SHA512 12430442fd9abfa6f5ca3c605b6158c37ac8b0bbe682b4fb6967f3b7c573207eb0c4756f6814e94542f8da1b77f53db61a4583fd674c97f6d20a317ac16bd179
- TLSH T164419DF793B4857E861196F4EB156E1FCE6A1624531C3CA688D46E1B43F2972D20078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5ac4cbc5-e0f5-4c40-bbff-01c89bad416d.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 79c04ff3e4eccdd08fa9ac5f79371f0aa2a89abe7bc94c151c02fe0468876672
- MD5 eeb43ac64757144ded8eabc0c3475c48
- SHA1 384f90a3d80353696989377e2e5ebd5a09f98e5c
- SHA512 40aea3b5914960f0eb29d9c43cfae0073ce899ed256ff698a1bc539edda56d21c7e48b7318632048dcacdac7389c9be0f0a7d9dc86099deb5825c93e976d3c18
- TLSH T17FB0120581812312C00603B021A0A07833708F35E51253A581FC1D438C321525257218
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 aad0c1b7ac2763894bbf6955e8423fc57333c65234b420a0c9a28e6784dd01a9
- MD5 54b391f86fa4f707c68a125bf0c115cf
- SHA1 f20f649c8c4b1afdbeccaa255538e21eb3f5f872
- SHA512 aff1022aa426e3fc80a2114047e9ce4fffd1f68de17073a8b11f23f6ff71c5ca273d248b4d743269c7217e95f9e3f1e9e7e1fa0668a772c97fa9f90f3d73f3d2
- TLSH T1B4B02228C202A203C08203B028C082E83020CF20C2030302C2F20F22CC2022020B8C20
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\dbc7edd7-1859-4c52-a5ec-94792b34e02e.tmp
- Size 414B
- SHA256 84d1fac23ab0f49cd63ac20e9a2683b3f697836849ad455f9554f83e4804d623
- MD5 c3147dba2cfc6917c452587b45503e54
- SHA1 05f599032b07105d7134b59a63b8ec11723169b5
- SHA512 4fbbeac347b8c1dbd4e53242f0e4e9aa53ea521f1215f6ac6b0aa6b62ebef5f6c2e79ea250d97f24f916e623bb394c7e735ccad720d3469ebdcda82c8b4449f4
- TLSH T1A0E02BAAC8119C2759FE0B286291C689EB54232B3F404D4F3B3C81188FB013A86D995C
- MD5 SHA1 SHA512 TLSH