Overview
overview
4Static
static
3ZenithMacr...m.html
windows10-2004-x64
3ZenithMacr...m.html
windows11-ltsc_2024-x64
3ZenithMacr...dex.js
windows10-2004-x64
3ZenithMacr...dex.js
windows11-ltsc_2024-x64
3ZenithMacr...dex.js
windows10-2004-x64
3ZenithMacr...dex.js
windows11-ltsc_2024-x64
3ZenithMacr...dex.js
windows10-2004-x64
3ZenithMacr...dex.js
windows11-ltsc_2024-x64
3ZenithMacr...ing.js
windows10-2004-x64
3ZenithMacr...ing.js
windows11-ltsc_2024-x64
3ZenithMacr...ion.js
windows10-2004-x64
3ZenithMacr...ion.js
windows11-ltsc_2024-x64
3ZenithMacr...dex.js
windows10-2004-x64
3ZenithMacr...dex.js
windows11-ltsc_2024-x64
3ZenithMacr...inl.js
windows10-2004-x64
3ZenithMacr...inl.js
windows11-ltsc_2024-x64
3ZenithMacr...api.js
windows10-2004-x64
3ZenithMacr...api.js
windows11-ltsc_2024-x64
3ZenithMacr...api.js
windows10-2004-x64
3ZenithMacr...api.js
windows11-ltsc_2024-x64
3ZenithMacr...ion.js
windows10-2004-x64
3ZenithMacr...ion.js
windows11-ltsc_2024-x64
3ZenithMacr...bin.js
ubuntu-18.04-amd64
3ZenithMacr...bin.js
debian-9-armhf
4ZenithMacr...bin.js
debian-9-mips
ZenithMacr...bin.js
debian-9-mipsel
ZenithMacr...dex.js
windows10-2004-x64
3ZenithMacr...dex.js
windows11-ltsc_2024-x64
3ZenithMacr...dex.js
windows10-2004-x64
3ZenithMacr...dex.js
windows11-ltsc_2024-x64
3ZenithMacr...dex.js
windows10-2004-x64
3ZenithMacr...dex.js
windows11-ltsc_2024-x64
3Analysis
- user interaction
yes - max time kernel
150s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/07/2026, 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ZenithMacros-1.1.6-Unlocked/executable/LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ZenithMacros-1.1.6-Unlocked/executable/LICENSES.chromium.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/lodash.isequal/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/lodash.isequal/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/mimic-fn/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/mimic-fn/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/ms/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/ms/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/doc/error_handling.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/doc/error_handling.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/doc/threadsafe_function.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/doc/threadsafe_function.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/napi-inl.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/napi-inl.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/napi.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/napi.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/tools/check-napi.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/tools/check-napi.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/tools/conversion.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-addon-api/tools/conversion.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js
Resource
debian9-armhf-20260513-en
debian-9-armhf
6 signatures
150 seconds
Behavioral task
behavioral25
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/node-gyp-build/bin.js
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/p-locate/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral28
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/p-locate/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/p-try/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/p-try/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/path-exists/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
ZenithMacros-1.1.6-Unlocked/source/node_modules/path-exists/index.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target ZenithMacros-1.1.6-Unlocked/source/node_modules/p-locate/index.js
- Size 1KB
- Sample260724-ejba6a1vdt
- SHA256 8e5e49ae61d019cf6f74e59e114190fc06bafa85c2084d1731b3ccbeb445e572
- MD5 6a5e5e9fe8db48b83d75aaf731622812
- SHA1 fb45398285a3e43f7adffaeda9b2cc87797db9f1
- SHA512 a4214f059ead2c6085d2501584b5cc0b2b09d8aee361262f3f9202e02a2f0cc2f2d1699be1f829a0a48f30b9f579cdcbe252cea8fb2d2e6f440482909b516f0d
- TLSH T1BB11F04B5373B57356B432E5B94C5D0BA12BA4007C11CCD0709C29E021CBE55EED385B
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1720 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293395003652268" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe - Suspicious behavior: LoadsDriver 14 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 672 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 4544 wrote to memory of 3372 4544 chrome.exe 103 PID 4544 wrote to memory of 4892 4544 chrome.exe 104 PID 4544 wrote to memory of 1720 4544 chrome.exe 105 PID 4544 wrote to memory of 4892 4544 chrome.exe 104 PID 4544 wrote to memory of 2812 4544 chrome.exe 106 PID 4544 wrote to memory of 2812 4544 chrome.exe 106 PID 4544 wrote to memory of 2020 4544 chrome.exe 109 PID 4544 wrote to memory of 2020 4544 chrome.exe 109 PID 4544 wrote to memory of 1072 4544 chrome.exe 108 PID 4544 wrote to memory of 1072 4544 chrome.exe 108 PID 4544 wrote to memory of 1420 4544 chrome.exe 110 PID 4544 wrote to memory of 1420 4544 chrome.exe 110 PID 4544 wrote to memory of 4772 4544 chrome.exe 111 PID 4544 wrote to memory of 3344 4544 chrome.exe 113 PID 4544 wrote to memory of 3344 4544 chrome.exe 113 PID 4544 wrote to memory of 1868 4544 chrome.exe 114 PID 4544 wrote to memory of 1868 4544 chrome.exe 114 PID 4544 wrote to memory of 3672 4544 chrome.exe 115 PID 4544 wrote to memory of 3672 4544 chrome.exe 115 PID 4544 wrote to memory of 2964 4544 chrome.exe 116 PID 4544 wrote to memory of 2964 4544 chrome.exe 116 PID 4544 wrote to memory of 1944 4544 chrome.exe 117 PID 4544 wrote to memory of 1944 4544 chrome.exe 117 PID 4544 wrote to memory of 3480 4544 chrome.exe 118 PID 4544 wrote to memory of 4456 4544 chrome.exe 119 PID 4544 wrote to memory of 4468 4544 chrome.exe 120
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ZenithMacros-1.1.6-Unlocked\source\node_modules\p-locate\index.js1⤵PID:2208
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9a49ac728,0x7ff9a49ac734,0x7ff9a49ac7402⤵PID:3372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,2324664884442326702,4596230342994705512,262144 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:22⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,17900793249130737070,5417302318822430435,524288 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:32⤵
- System Time Discovery
PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,13103111187199114820,4356494424315264981,524288 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2604 /prefetch:82⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,3452788750738517876,12558612067729805278,2097152 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3100,i,118605201626016759,14007701354359923419,2097152 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,9921385153161783836,10426724419506379884,2097152 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4608 /prefetch:12⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,16645334302906847321,1056888656766748730,524288 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5284 /prefetch:82⤵PID:4772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5796,i,15705589057159621498,12361913830823735958,2097152 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:3344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3388,i,9675313662499342152,3491464215104485165,2097152 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3976 /prefetch:12⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5932,i,7341940555232097919,18311966373514286747,2097152 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3700 /prefetch:12⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3968,i,11349456540082747544,16986565643049099642,2097152 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3632 /prefetch:12⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6104,i,3263185914229460009,5920945779042628134,2097152 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:12⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,12738447893738137217,17592675057777865459,524288 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:82⤵PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,13160971265271006721,5441558639627160579,524288 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4676 /prefetch:82⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,11701411159343852416,14982985124701674371,524288 --field-trial-handle=1996,i,16131035675571611142,3015177342076154834,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:82⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 7832b111ee142f544a0cda750d7b5f5ef0c253698dac18c13f882a90f4216ef6
- MD5 57f112db326cbb74a4b457664c8f40af
- SHA1 c493b26eb1f26a426684d04ca27b585dc534e927
- SHA512 2974530bbb079bb5bcfe245be063fd9e36be5dbba105de1f41aaf2559ff4d41472d99aac80c4f4793f37db0c0a388c2b4716b44d53075e4e0a3656024a88e3ac
- TLSH T1ACE0E5EFD926AC7768F9472860514746EA4013573B908A4B363D810ECFB46760546C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 552B
- SHA256 298dc12e9a81d3d736ed5dc69ce9d71258c1b75c667de1bbd696df2c8b214551
- MD5 96ab5093eaa01cb23dffb937fc565c29
- SHA1 93448ba8fa103e881e35730b0184d25917c62d35
- SHA512 021ab7fe6e805e450d73a9be98e3e722feb80b68fe0380c5fd1f4d475f33a397e4ae26581bb14b6ff9084825bfd2bae805a42cb3a89e46cd412a9ff0a54a3efd
- TLSH T19CF068D8B30311B1CFF8197626C92A08B4610F7D9512EF3E80C1003DFAAA7B80C0F151
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 b87604549715e4f57bc5297d493fdb97fec4fb96bfd3436dd1aeafdcd6260b49
- MD5 c951be79beb575f37d36fa58c6c81a59
- SHA1 936cd3a65a05c1b34cf534ed90f35ea9053eb3de
- SHA512 e0bda89195018b9684a99f864ca8cabf1b7ff5209ff323bb0a5d985938fe10a9cca2159c4f96a0d6f06046988b4a68082524992225da99a7bae5e38903f6b77d
- SSDEEP 192:vRycBzCx41v78pAPRp2ZeR3B9DHsb+WNCXLFqB7I2EqIVykwAVyIsnAUgraJ:vRymzCOF4UXJ5wtW2Eqwyke
- TLSH T1FB52C56FAD5019BB5CEAD225F921BB67E3F61023A2D51E84E6FC8A1C14E75CC321710B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 c368c698a6dd5fc7911bc13803be739cdceab216784804ff77e7f07fbcc8150b
- MD5 6fd8db4df2b0a928543a620ff97f5756
- SHA1 d54349b20b701abe1a60e8e7126244855f4f7d58
- SHA512 0362c74b2d1edeee68d4e9990ad2849b25d0546193531debc45514e9f4e6f11aa88939a174452a404768f835cdff1db82c425b080c19039090caceb186aa9d9c
- SSDEEP 192:VORycBzCx41v78pAPRp2ZKg9DHsb+WNn7447I2OIVykwYVyIsnAUgtaJ:VORymzCOF4UXo5wM72Owyc8
- TLSH T16652B52EAD50657B5CEAD225F961BB67E3F61022A2D51E84E6FC8A1C14E75CC322700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 5791496506c63d3df5010d94ecf14589cfe975c107589e023d62a0062f0d0fb9
- MD5 b97499b2a277aeefcab962a2509b8df0
- SHA1 75fb7c2c7ef3460a3dddb00f887ded837f2b2e73
- SHA512 834c25ec99e4b67c230797ee410917cfa28c6dbafc8c62a1618c07dbf0f6096acd098abcf8097f643418df365e811e68eb9b6d88e87f57eebabaf643f53714d3
- SSDEEP 192:vRFcBzCx41v78pAPRp2ZeR3B9DHsb+WNCXLFqB7I2EqIVykwAVyIsnAUgraJ:vRFmzCOF4UXJ5wtW2Eqwyke
- TLSH T15052C56FAD5019BB5CEAD225F921BB67E3F61023A2D51E84E6FC8A1C14E75CC321710B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 14KB
- SHA256 05d3ca39e2ffa1e55d9c1e1726e680aae055ba08601748a50119047aa24ecc2e
- MD5 f95652e13e028b3d1353a22fc1e4867e
- SHA1 4b59cba0976a73f25e2a3642df463efc259383c5
- SHA512 010c1d4933cd84d3dc40b00e07c2c41e63ca3f8e7f6a44b8b68f79318fa82589b461d6245eb62a37e90a41d1ade5fb0585eee102c8969b43e6ec43b4637e6e9c
- SSDEEP 192:vRycBzCx41v78h9PRpZZeR3B9DHsb+WNCXLipW7I2mqvVykw+VyIsnAUgraJ:vRymzCOF4nXM5wpJ2mqdyWe
- TLSH T17762C65FAD5019B75CEAD225F861BB67E3F22023A2D51E84E6FC8A1C14E75CC321710B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
- MD5 be6f9d6a2cbcb56c02708e735863c266
- SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
- SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
- TLSH T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 96B
- SHA256 985ee11c9151ee35dd8fe06f0a7e67000e568941540cfd2be95dd7623d467693
- MD5 1c1b4b02492590e7c55adeadae7838d8
- SHA1 24d9992c02976ec6db3eb7c1375681ab219ab5d1
- SHA512 b76f8e54dbe8bb2e858bc1c28dfbdafed3fa8c1ae16ec8dedfa320a2c7053906dae61f2156e3e4fc48562d823b1efa0d3c0d1e1fe027afa56eca5898ca45f9bd
- TLSH T1BFB00255B5005532D4591774F0EB594D77704C1053C31E138DA100F496187DCC117B06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 617bd65bfe665ffc1bc4c24fd018e4b85b5303c5b72f4323d6c78ccbcdd5573f
- MD5 a08fa00363e8ca5cc0b07d792cdee7a4
- SHA1 cd957d32b8cb28381eefbc556c9e3260ca0a835b
- SHA512 e90c26936cf167cd4944f56a8490817efdf040b6efb638f5aff73e46fead1aa1c4707ccea99de2e7844bcb3e6594721df725a60af0c1585eb4c3ca060d31f656
- SSDEEP 6144:Wa7a2aUEcgsFXOPnd9m7Rkm1tYpBeh2BAox:WGosh4nW9oBGcAox
- TLSH T15734232ADD75EDB609ADB74EB0451B2E1DF118E3D144ADD0C9898E0A73FA3EC2606C34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 74bf455a157533b36c5e462ddf4242dda5affdae6223f4692176deceef7983c4
- MD5 3822ffcaea5b39acfa2af459464f093c
- SHA1 c9ec150e1903d8c7a0c258823655546a6ee33d5a
- SHA512 eb186f930cd01c0f27b33fb80808d4f86516831ddd2aac1802e1bdb1d301b0bfdc6632865515e83f63a698213b45c6d378b2cdb9e1b28753992d32a05466930c
- SSDEEP 3072:LGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Sm7Rkm1tYpBeh2BAoO
- TLSH T125C3123B5D65E9775D78A70EB48E0B1E1EF249A6C930DE4288D86B0437FA7CC1A04A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 e62aa839964ee8567cf8bae9030e1782627ec7c7d0b4ca363653615d3b5195c7
- MD5 cdefb2212a780b2acf8055beac9d8f72
- SHA1 e090c0c12751c8ce2d81d9a08d12aa7acf83ec20
- SHA512 c1908af40fed24eb3c90f623438f00979627a529d14106d9d27a2fea53c2dd6f55f09893c139d5599503b391d8fc01949f73c67ff7023fa545f52924536a0e45
- SSDEEP 6144:na7a2aUEcgsFXOPnd9m7Rkm1tYpBeh2BAox:nGosh4nW9oBGcAox
- TLSH T19534232ADD75EDB609ADB74AB0451B2E1DF118E3D144ADD0C9898E0A73FA3EC2606C34
- MD5 SHA1 SHA512 SSDEEP TLSH