Overview
overview
7Static
static
1NetherPack....5.zip
windows10-2004-x64
3NetherPack....5.zip
windows11-21h2-x64
1assets/min...es.bin
windows10-2004-x64
3assets/min...es.bin
windows11-21h2-x64
3assets/min...d.json
windows10-2004-x64
3assets/min...d.json
windows11-21h2-x64
3assets/min...g.json
windows10-2004-x64
3assets/min...g.json
windows11-21h2-x64
3assets/min...h1.ogg
windows10-2004-x64
7assets/min...h1.ogg
windows11-21h2-x64
3assets/min...h2.ogg
windows10-2004-x64
7assets/min...h2.ogg
windows11-21h2-x64
3assets/min...h3.ogg
windows10-2004-x64
7assets/min...h3.ogg
windows11-21h2-x64
3assets/min...h4.ogg
windows10-2004-x64
7assets/min...h4.ogg
windows11-21h2-x64
3assets/min...s1.ogg
windows10-2004-x64
7assets/min...s1.ogg
windows11-21h2-x64
3assets/min...s2.ogg
windows10-2004-x64
7assets/min...s2.ogg
windows11-21h2-x64
3assets/min...s3.ogg
windows10-2004-x64
7assets/min...s3.ogg
windows11-21h2-x64
3assets/min...s4.ogg
windows10-2004-x64
7assets/min...s4.ogg
windows11-21h2-x64
3assets/min...l1.ogg
windows10-2004-x64
7assets/min...l1.ogg
windows11-21h2-x64
3assets/min...l2.ogg
windows10-2004-x64
7assets/min...l2.ogg
windows11-21h2-x64
3assets/min...l3.ogg
windows10-2004-x64
7assets/min...l3.ogg
windows11-21h2-x64
3assets/min...l4.ogg
windows10-2004-x64
7assets/min...l4.ogg
windows11-21h2-x64
3Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
NetherPack_2.0_1.16.5.zip
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
NetherPack_2.0_1.16.5.zip
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
assets/minecraft/font/glyph_sizes.bin
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
assets/minecraft/font/glyph_sizes.bin
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
assets/minecraft/models/item/shield.json
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
assets/minecraft/models/item/shield.json
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
assets/minecraft/models/item/shield_blocking.json
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
assets/minecraft/models/item/shield_blocking.json
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
assets/minecraft/sounds/dig/cloth1.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral10
Sample
assets/minecraft/sounds/dig/cloth1.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral11
Sample
assets/minecraft/sounds/dig/cloth2.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral12
Sample
assets/minecraft/sounds/dig/cloth2.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral13
Sample
assets/minecraft/sounds/dig/cloth3.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral14
Sample
assets/minecraft/sounds/dig/cloth3.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral15
Sample
assets/minecraft/sounds/dig/cloth4.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral16
Sample
assets/minecraft/sounds/dig/cloth4.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral17
Sample
assets/minecraft/sounds/dig/grass1.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral18
Sample
assets/minecraft/sounds/dig/grass1.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral19
Sample
assets/minecraft/sounds/dig/grass2.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral20
Sample
assets/minecraft/sounds/dig/grass2.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral21
Sample
assets/minecraft/sounds/dig/grass3.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral22
Sample
assets/minecraft/sounds/dig/grass3.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral23
Sample
assets/minecraft/sounds/dig/grass4.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral24
Sample
assets/minecraft/sounds/dig/grass4.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral25
Sample
assets/minecraft/sounds/dig/gravel1.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral26
Sample
assets/minecraft/sounds/dig/gravel1.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral27
Sample
assets/minecraft/sounds/dig/gravel2.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral28
Sample
assets/minecraft/sounds/dig/gravel2.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral29
Sample
assets/minecraft/sounds/dig/gravel3.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral30
Sample
assets/minecraft/sounds/dig/gravel3.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral31
Sample
assets/minecraft/sounds/dig/gravel4.ogg
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral32
Sample
assets/minecraft/sounds/dig/gravel4.ogg
Resource
win11-20260130-en
windows11-21h2-x64
8 signatures
150 seconds
General
- Target NetherPack_2.0_1.16.5.zip
- Size 2.3MB
- Sample260420-t384vsay5l
- SHA256 7d5a61729f22d2a478fdc34e21e6fd4a114388b28235ca34375349ce933a27ea
- MD5 cfceb0b902eb4eee1f61f4e1e7f01497
- SHA1 e4931f43ca4f7c3bb0f68464283f5735c878f810
- SHA512 90d964fe477cc61d77d4f01b7449c13411cb9ec79b5c2161ad2c7b9ab76ccfee9325172c1afc10bf8377dc3769681af6b16e8aa2f87fb6edb053022e0a82fcb4
- SSDEEP 49152:a+ESnBMNcUCvRxZfhT0tZjNzxFVWJp7sWHOYN7MlfBKEJ4MuPLtSpAsLgZ1kWzA3:P1qN8VhQrNVza7syOc7MlfBKEJ4MuPLk
- TLSH T1F0B5F1A9D737AD90D59FAE3A04BB1193F864863A5818F3FF613890567FCEDD00116A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5200 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211767120448435" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe Token: SeShutdownPrivilege 1728 chrome.exe Token: SeCreatePagefilePrivilege 1728 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe 1728 chrome.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1728 wrote to memory of 364 1728 chrome.exe 103 PID 1728 wrote to memory of 5188 1728 chrome.exe 104 PID 1728 wrote to memory of 5200 1728 chrome.exe 105 PID 1728 wrote to memory of 5188 1728 chrome.exe 104 PID 1728 wrote to memory of 5216 1728 chrome.exe 106 PID 1728 wrote to memory of 5216 1728 chrome.exe 106 PID 1728 wrote to memory of 5776 1728 chrome.exe 107 PID 1728 wrote to memory of 5776 1728 chrome.exe 107 PID 1728 wrote to memory of 5684 1728 chrome.exe 108 PID 1728 wrote to memory of 5684 1728 chrome.exe 108 PID 1728 wrote to memory of 740 1728 chrome.exe 109 PID 1728 wrote to memory of 740 1728 chrome.exe 109 PID 1728 wrote to memory of 3144 1728 chrome.exe 111 PID 1728 wrote to memory of 3144 1728 chrome.exe 111 PID 1728 wrote to memory of 4736 1728 chrome.exe 113 PID 1728 wrote to memory of 2356 1728 chrome.exe 116 PID 1728 wrote to memory of 5656 1728 chrome.exe 117 PID 1728 wrote to memory of 3596 1728 chrome.exe 118
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\NetherPack_2.0_1.16.5.zip1⤵PID:4976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc4382c728,0x7ffc4382c734,0x7ffc4382c7402⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,16863750120103505306,9004004741452453994,262144 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1884 /prefetch:22⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,864217118685066845,4320438478411198177,524288 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2188 /prefetch:32⤵
- System Time Discovery
PID:5200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,5034985669004363803,17958251545413147391,524288 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:5216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,10461867570481079166,805408390521248015,2097152 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:5776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,3267702654228362335,3266863033203245306,2097152 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:5684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,13754972450594652888,12604746218166779438,2097152 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4332 /prefetch:22⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4780,i,4782103685623011016,4263670675176471150,2097152 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4600 /prefetch:12⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,12957933804780482073,8928077579893195520,524288 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,14899558280133525576,6457958650263076695,524288 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5812 /prefetch:82⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,14778894066445906121,5352519212669419822,524288 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5672 /prefetch:82⤵PID:5656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,3914854746806747654,1483603100415318846,524288 --field-trial-handle=1888,i,3687429281781435788,1463024954228481704,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5868 /prefetch:82⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1616
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 7ebc52579ceb5bf7f1d95b491acecb1e7e622639cb6e5dea4b159b50f3cbe6d0
- MD5 b209ba79c9559349c93f1e4208d791fe
- SHA1 3f028ccc62311e64b03c0ad448c89bff33931289
- SHA512 558900f14c12fce941c7d49ea51c75b76a276120c4c5a576c7723e9d8c32367af94b44bb6b7a9359a75d0769b02c616899c37910818d55d8e6436ef6b4532db5
- TLSH T1E5E0E5AAC8A6E82B08F917186054470AEF1017562B41590B7A3D850C8FB127A458A86C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 6901c22e135acfe671e3f7271561dfdd9a037589f8b78483548f68a892f72637
- MD5 0ea6631b543b8bf7fd7dd83df3236145
- SHA1 daa1b66d1b810c3d48368b9dd8b2e7eaec1753b1
- SHA512 bcd9831875c74b355826254b91cc9d045042be6d0481d81ee89e99f5b0561270dc4b7de97239e41dd14b8330963a87fdff65c6ed2b9411a02e22b88c4af5343d
- TLSH T1D2518DF7D3E8967D891162E4EA246E2FCE690A14131C7C62C9D4AE4B43F2972D20179E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a7f423a2-1301-44cf-b23f-e4699f262b95.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 aac7da1fda2cdfb3a687fd9ada27c748d2a5db3fba1a4040cb1f1ea1e5c8b6fc
- MD5 2574d7e75996577dbf019b37d051727a
- SHA1 5db8d8b2e428289c5fde343b27d947b350152b11
- SHA512 beefb2c54a1116ea2356c664b4cf9119393ae7393fcad38d83de45c852d080b60d8cdd8d1408ae806e164a87f3a9e6957d62e77d25b187be75352515925f844f
- SSDEEP 192:ERbpBfmU3jVv7jahAPRp2w9mHsb+WNntm5+yeLbyk2KBgtZ/w6auJVyIsnAUgtaJ:ERbpBuwla8XbIwM5obyk2Yg//w6auv8
- TLSH T18B42D92DE914743B5CCBD229FE667B57D7F9102161942E84EEFC8A2C05E76CD221B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 a690528c201ad7957d1acbb66785b07edc7c65fc43c02df6d2d10b745fa936cc
- MD5 18a91ff5437e725c7f85bd3d02b336c8
- SHA1 f4537d78b343003018a9186fc3bfd22b0f98866a
- SHA512 e52cf909a972bf94d5d4fa9a14669644e5c3e33e708c6c4830985f3eb7a0731e5615d495a2f7f07abf36d4c1dcb3c633ce94e08723e884b639c78b2ad5f3844b
- SSDEEP 192:ERbpBfmU3uxv7jahcPRpKw9mHsb+WNntm54yeLbyk2KBgtZ/w6agJVyIsnAUgraJ:ERbpBuvha8XHIwM5+byk2Yg//w6agve
- TLSH T1C452FA2DE924687B6CCBD229FD667B57D7F5102161902E84EEFC8A2C05E77CD221B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 042e1b29d1786ee01def7b8eba7d30dcbee049b2052a10245a2c52a856721c94
- MD5 3ae9f415fd985ecb9f0b36d12c0e6b8d
- SHA1 bb73c4ec096f751f9a7d30a486db15727f044aac
- SHA512 64e95cceae71ebd806a2846171ab98f6507ab60e80ce0fe2a08b5cdd2e10b02ed70cf7743400841ffeea6f22a2b1c07ac6844fd595813d72dc7fb6f1ccdaf527
- SSDEEP 192:ERbpBfmU3u0v7jahAPRp2w9mHsb+WNntm5KyeLbyk2KBgtZ/w6aUJVyIsnAUgraJ:ERbpBuvwa8XbIwM5cbyk2Yg//w6aUve
- TLSH T15542E92DE914647B6CCBD229FE667B57D7F5102161902E84EEFC8A2C05E77CD221B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 bf62e1049de95d65f47624d7798bde5744eb951e0ed0ea25ddba294063ffa7a7
- MD5 49562669770328f66e1325b3c903792e
- SHA1 46623a8c52a6bd4f9da91ea8ee7b9312de96923e
- SHA512 3367b20a292ac13fc158c4e00e04d9cb63594709899cd0260a168241f577fac9c36b31945ef07da242ac40bac5bd3b7c6655e3df64a2c5b7c19b12c76cde6163
- SSDEEP 192:ERbpBfmU3jVv7japAPRp2w9mHsb+WNnmzd5yeLbyk2KBgtZ/w6auJVyIsnAUgtaJ:ERbpBuwlaUXbIwIdZbyk2Yg//w6auv8
- TLSH T12242E92DE924743B5CCBD219FE667B57D7F9102161942E84EAFC8A2C05E76CD221B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
- MD5 6932e737f9fb5bb798f741f34796b7e1
- SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
- SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
- SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
- TLSH T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 2fb0fd4117539c4559418268c699bf17e25487d4396c03d4ae3fd73a5794af4d
- MD5 acbf5623cac448e7e5fc01d2327dbd3a
- SHA1 9a3e48c4c7edde6d7d458811efd0085877e3fb21
- SHA512 f0bb00f5d575625ab50f1e7636642fdca1927893cefc0c8d37211a13c3551151e33b7abc34daba173c924ee8740d0d369ff1bc92e9a77428eedb4a2a98d6f3ea
- TLSH T16DB012A18001A721C44303FA17C644C83114AF24870E130553F06972DC262D040147A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593975.TMP
- Size 96B
- SHA256 0439cd14211ea8c9afb350af1f7ec25a5371f71777060cfe45905a5ee4d7c466
- MD5 67e0390604884f004bd18a66d96101b8
- SHA1 228a170e2bd8da3d242bdab0c9ce1240f3830cdf
- SHA512 3de6391bf6d05a147c55e8bc5c05c2d9a472710e15c78f16df7f6d6bde2880c4eff4b660e41e8e5ae99336df2d3fe671c5bccc5913c449f63fa195c5ea9b828b
- TLSH T1D5B0025AD303B213C44613B43D95DDD87170DF65C6076226D6E01A6BDC356A1C639D60
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 90KB
- SHA256 45ffacb4ffdbd75e34d5838c8dfbf15a9bd5ef199656b7def1a6ee3f6ae9deb9
- MD5 2640d2fe1dc3f650ac7b9178516da869
- SHA1 178d87279707af323b4c12d470111dbd7143551c
- SHA512 a1103ac3af2b7fb327bfe4f7bc342aa438ca4190069de9e605c2fcb7b1adabc8b634d3ac2b7859b98919bdd28e9f6aac548a35e83285fdd0fa4cb4884bdbc518
- SSDEEP 1536:0cCJ6cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9L:0s3Qw/xLANk0mUW5GmRntSFCjEENj
- TLSH T1899312BA9E1A46E7997E4691769E780DCE13130D709FA8CC7258538C21D01C92B73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 194KB
- SHA256 779a1cab380a9b1389e5fffc4d68fc807071bc5258e94798629940c131b04d0f
- MD5 a170d7dbc0e43c2f1ba582afcddf8e70
- SHA1 07a5baab39cc27c80c2a3bbd1179949ba08918f3
- SHA512 900bf9ade4f578e1a37b23ff6e7f59e82293146d73d09d5da3b16f8afee5adcfc2bf1b085a8803d695ddee625f1b874f01428dcadceb93a8ddc5a241a27dbf8e
- SSDEEP 6144:0HlezIqEzsSZhAAd6hUsDrOk0HOGm/SFyEEG:0szuzsCOrOjuGdF2G
- TLSH T13C14127FEE1215D39DBD8AA9B24FB50ACC22A346F15AFC8DB4497384705D2941B73E20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 39bd43fcb89744654efacaf4ba8cdd01c43c55f704aa36581c636545fb506911
- MD5 e1212b0b84de929499bae62fd4dd68db
- SHA1 f72c3bf0d09952a6aecf964f07227a782d78bf76
- SHA512 6341a017abbe1fb69e27b362f8dd6c14a545be911f8a2f697de9281646317d8ff5ace35d6cf0357bffbbd059a2ee494f96d7616ba81f0783c6ebf2b3549f35be
- SSDEEP 1536:0cCIcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:003Qw/xLANk0mUW5GmRntSFCjEENW
- TLSH T12B9302BA9E2646E7957D469176AE780CCE13134D709FA8CC315C639C21D42C92B72F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 194KB
- SHA256 c5e3e0f63b039bed451a7ba86c547524d9c48dc07715e7b0488a56eea1c44b9e
- MD5 ebb6640af9965e79d3531e5cd7a604b4
- SHA1 35c3d1bd5760b1f82b247fdbed968944adeaee60
- SHA512 d2b70a6481bafe6c25092956f96915e7545fec82866df86c0e477c5698b19ee1935c6ba0f01073bc9bd362e69d8b1355d3dbd5c6dcc4cc9c05c6d5a7fa6d9ebb
- SSDEEP 6144:0TezIqEzsSZhAAd6hUsDrOk0HOGm/SFyEEG:0yzuzsCOrOjuGdF2G
- TLSH T12814126BEF1612D39CBD87A5B28FB50BCC126385B16AF9DDB509B38870582841773E31
- MD5 SHA1 SHA512 SSDEEP TLSH