Overview
overview
3Static
static
1extension.zip
windows10-2004-x64
3extension.zip
windows11-ltsc_2024-x64
1anti_blur.js
windows10-2004-x64
3anti_blur.js
windows11-ltsc_2024-x64
3background.js
windows10-2004-x64
3background.js
windows11-ltsc_2024-x64
3broadcast_patch.js
windows10-2004-x64
3broadcast_patch.js
windows11-ltsc_2024-x64
3content.js
windows10-2004-x64
3content.js
windows11-ltsc_2024-x64
3elementFin...ter.js
windows10-2004-x64
3elementFin...ter.js
windows11-ltsc_2024-x64
3elementFin...nts.js
windows10-2004-x64
3elementFin...nts.js
windows11-ltsc_2024-x64
3features/hotkeys.js
windows10-2004-x64
3features/hotkeys.js
windows11-ltsc_2024-x64
3features/n...ons.js
windows10-2004-x64
3features/n...ons.js
windows11-ltsc_2024-x64
3features/open.js
windows10-2004-x64
3features/open.js
windows11-ltsc_2024-x64
3features/p...nce.js
windows10-2004-x64
3features/p...nce.js
windows11-ltsc_2024-x64
3features/premium.js
windows10-2004-x64
3features/premium.js
windows11-ltsc_2024-x64
3features/send.js
windows10-2004-x64
3features/send.js
windows11-ltsc_2024-x64
3features/settings.js
windows10-2004-x64
3features/settings.js
windows11-ltsc_2024-x64
3features/ui.js
windows10-2004-x64
3features/ui.js
windows11-ltsc_2024-x64
3images/icon128.png
windows10-2004-x64
1images/icon128.png
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
143s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
extension.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
extension.zip
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
anti_blur.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
anti_blur.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
background.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
background.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
broadcast_patch.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
broadcast_patch.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
content.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
content.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
elementFingerprinter.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
elementFingerprinter.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
elementFingerprints.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
elementFingerprints.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
features/hotkeys.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
features/hotkeys.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
features/notifications.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
features/notifications.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
features/open.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
features/open.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
features/performance.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
features/performance.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
features/premium.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
features/premium.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
features/send.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
features/send.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
features/settings.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
features/settings.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
features/ui.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
features/ui.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
images/icon128.png
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
images/icon128.png
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target extension.zip
- Size 469KB
- Sample260727-rp9gcsvbnd
- SHA256 cd68efe3e016d2b88462bed9b712ba03f3f607e1220d1dbb9b2af9b415136460
- MD5 cef078828d44bdf36603ec41e00d5de4
- SHA1 198cd89c2cd0e5735ff74c0204fa4db42d16c675
- SHA512 46669e0e76fa4ebe08fdcfff4b19f4704619274b84e446ab89bb9f32cdff632b8b024ce69e0a066c36471e3f301019e1daf4ba19669b5e16a60d1370999c7adb
- SSDEEP 12288:J/jbhGjKev0I53zfn6oixpNmqZovNRnSm4BGUuNRcS:J/YhrAXNmqKvNpSm4BGtNRd
- TLSH T14EA4238DE3CA19F9FF1D17F2C5F3F745AA681E343CDAA2221C96C05134B560ACA9B185
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1096 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296358597128630" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe Token: SeShutdownPrivilege 1552 chrome.exe Token: SeCreatePagefilePrivilege 1552 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe 1552 chrome.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1552 wrote to memory of 4336 1552 chrome.exe 92 PID 1552 wrote to memory of 1748 1552 chrome.exe 93 PID 1552 wrote to memory of 1748 1552 chrome.exe 93 PID 1552 wrote to memory of 1096 1552 chrome.exe 94 PID 1552 wrote to memory of 2936 1552 chrome.exe 96 PID 1552 wrote to memory of 2936 1552 chrome.exe 96 PID 1552 wrote to memory of 804 1552 chrome.exe 98 PID 1552 wrote to memory of 804 1552 chrome.exe 98 PID 1552 wrote to memory of 2472 1552 chrome.exe 97 PID 1552 wrote to memory of 2472 1552 chrome.exe 97 PID 1552 wrote to memory of 4952 1552 chrome.exe 99 PID 1552 wrote to memory of 4952 1552 chrome.exe 99 PID 1552 wrote to memory of 3880 1552 chrome.exe 100 PID 1552 wrote to memory of 3880 1552 chrome.exe 100 PID 1552 wrote to memory of 1100 1552 chrome.exe 101 PID 1552 wrote to memory of 4344 1552 chrome.exe 109 PID 1552 wrote to memory of 972 1552 chrome.exe 110 PID 1552 wrote to memory of 3740 1552 chrome.exe 111
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\extension.zip1⤵PID:5028
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa0555c728,0x7ffa0555c734,0x7ffa0555c7402⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,14191851531155042741,18392739349302310526,262144 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:22⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,5512437560178568461,10590213648042116821,524288 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2176 /prefetch:32⤵
- System Time Discovery
PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,40141149632354442,697489571416138283,524288 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:82⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,8416163930004949320,16154685801379631977,2097152 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,16942347731816048668,8420324998432028771,2097152 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4456,i,2334454799419671278,8652916849697074514,2097152 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3960 /prefetch:22⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4788,i,3996441582855292827,11584481401392596238,2097152 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,9573456389748935993,17319196165387305488,524288 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:82⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,13859377712689989850,14989183358293584741,524288 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5952 /prefetch:82⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,3733252316957797439,14405290456596793446,524288 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:82⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,17485776165958024650,2834941660650199187,524288 --field-trial-handle=1972,i,3279459757008306600,13827477447145290430,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:82⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 f26f8035b0884f993216f51c90be64d937bd1e058b47a18c75228ee877635ba4
- MD5 34bffecdf5566f2b659606e0501b3639
- SHA1 362a30d0ef49b8210597923d6f88047b5430dd6a
- SHA512 45275d2f6d127e100d6a4cb198bdae4071db5ff4eae122e75d318366b9a84aa022b3e92299f6e8d38a730db499c344e56bd8655f8d671ca302551a03d8919a6e
- TLSH T1A6E02BA9C821AC270DFD1F3860540649FB5013167F90C95F3B3ED2188FB5A3A8666A2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 dc73108344153358f8f510163ce6ff66374e63a00ed835711155685abd7044c4
- MD5 ba22c7cb9a10704987f2f0331da3666a
- SHA1 631b3d318d71c9131972a635248c849865d36b4a
- SHA512 28041c2de84340002cba7629b5f4fb3c00a6c39eebf021e966c79e4539711c288d037faf16f680ccab59f1efa1f0b727f24a3e80ac2fec0186e62bf4b6d75027
- TLSH T193518BF7D3E89A6D895152E4EA216F1FCE3D0A24031C3C6688D4AE1B53E2972D21134E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 55fe8562439b487854fa6fb6d204921a1c5a79417987d9a75d1418bbcc63b203
- MD5 4359aeb54e323e5ddc270466221c248e
- SHA1 b79edca973a8db92468d552803c6da5ccde7a468
- SHA512 de080e0f0c7d9eb1012c89fe17b16d1eee8dc76c222a35f82140e7135823b288fe4296b1affd8e32542a882bfcdd64b2c94fb997efd3055b25cbf0615a17719d
- SSDEEP 192:yRlwQh2B57jg+FiEv7cpAPRp2qg9BHsb+WNne90RcPawuwBuFVyIsnAUgtaJ:yRlwQwrPJigwUXlgrww06aRz8
- TLSH T1A342E82EB910797B8CDAD22AF9157B57EBF5102526942EC4E6FC8A2C14E76CC221701F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 82665e3436be3a7c0ebe427570524caa4e52df7ceb74928189bb26bc21d702c6
- MD5 e604bb513d63f9688576d3cb1f5b638a
- SHA1 b0bc521c65512869e0ea77cfc0e61d7fd54a74db
- SHA512 fc343e1e3f0334a8e34a7b44a4cc2b82904a869e0855585c681b6a3c5102d2ffbb76730e28650bb10695496855800dccc01e49b1e7e13f3439ad6c0bdac5b376
- SSDEEP 192:yRlwQh2B57jg+Fiuv7cpAPRp2qg9BHsb+WNne90IcPawuwBFFVyIsnAUgraJ:yRlwQwrPJiKwUXlgrww0na2ze
- TLSH T15442F92EB910787B9CDAD229F9163B13EBF5102525942EC4E6FCCA2C15E76CC231701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
- MD5 248039e3512518ae98cef47428956f17
- SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
- SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
- SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
- TLSH T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 46e236d539cc6695fe2107d5a69e68b64923ff114e185f892a9ae7bf0bb64732
- MD5 9d7feaa22d010f84fa9e18c0b10a184e
- SHA1 d63fb99746a1c94e3fe41ff33392020149607a2c
- SHA512 7bac4b35e60b676c396fe65e65760d3a25ba7282b7b9c6a5f37115d2b10da3af10abe85e97c99e7922c976facfa25ba5af2b9b4e6d2f774f0b1b7e6e31aba036
- TLSH T182B0120084029912C08202B0215214987164EF14D61E1F0243E07922CC359618414150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5923da.TMP
- Size 96B
- SHA256 66a7234a8f1d421ceffb8e156085d19cf00c68aabe9a513438cee0d2073aff73
- MD5 555350e1fbcf01dd6e89824a6f7e50d9
- SHA1 918ceb4e187b69a9fb25bf01ca614efee7a35698
- SHA512 b19ec8e7a1e13c8e3cede8072ffc030669506654a05c0ed7d2d7f7330b30ea29c9893e5632d545c2e780140b726d286e2562ee27502882551e3ec0eb66df8f1b
- TLSH T124B02208C003AA22C08203F82AA0CFC83228CFA8C203030282E02A22CC222300AA2220
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 095f454d891af9df6b712f65e0691c72820cea6f4211c4aadfd231083317ebd7
- MD5 4c7699a16fab4104e9ee80142653fb8f
- SHA1 54e5661bc06258e8adad74f7d847141f283e420c
- SHA512 65ac1a544f2febc87091ea0aa6df70c11a0ea58c369fca98fda091e6c24b5e53b490ad1b216c621d16c9e8156a6c25c3e547348af6c4d2759862737143ae9c9e
- SSDEEP 6144:S5gBUb9VgUEcb4/MsIT+CvZBcFmUi21rSm8uUVNSlzYy:Sbb9VgJ/OTZB4fi21b8j8z3
- TLSH T13E34233068627CF36DED1055F5CE2E292EDCCEA246C085464763DF4259EE3D3A74AE60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 50bb32ef81ce9a386880b1fc0724550933db5cf9fccbea8f558f51a2eeaf52ae
- MD5 ac0e14b0071cb7d0318f56fa8353e0ba
- SHA1 4e7f259f2b202d81d8afeb4bcfcebfa252c72e46
- SHA512 16e92a115c3a5dcdf030a58f90dfb4f061b5fa3c3215b1da68ad22e13b079578aec2a90e3079327a13920309bef6757ad37a0227e3eb5d88a66025ba3de3e1aa
- SSDEEP 3072:SHFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:GFmUi21rSm8uUVNSlzY/
- TLSH T1DFC31304BAE3E8F2EE5930447BEE2A145D6C4D818291C6415273AD419DEF3C71FAAB39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 3bfaeb7a50bbfd3483a5c447f496d47b944916bc5954a093bb95b2e2d64dee50
- MD5 a97a954e78e608331337a7e122609e10
- SHA1 5e8bfd4bc892c1ed03bcd3941a988ad2fa7476f2
- SHA512 4a8fda5e82e5a31e6a301f97dd37c3a4dedfa10c892cb0a24a060672589aa9ba370288295c926491a2aa4303734b865790216d3775a25f96f241d327abd5571f
- SSDEEP 6144:TaBUb9VgUEcb4/MsIT+CvZBcFmUi21rSm8uUVNSlzYy:THb9VgJ/OTZB4fi21b8j8z3
- TLSH T17A3423105863BCF36DED1065F5DE292A2FD8CEA141C085464773DB825AEE3D3674AF60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 848736462a168e5ac17d73bb41f78e06e564f3633d6a8713b308381529786849
- MD5 5a67db07b2bd5aa62f0088087da8a86b
- SHA1 9ab348dabf361ac6d7c70ff47ea4b9496a3a2354
- SHA512 dac15c85a0691ee61061de7029219b62833be03c855e4df3078d801c945576ddd3b74ef065592db1a8b51e4b1f74332d5ebfc1565e52c3aac06054b516a540f9
- SSDEEP 6144:SaBUb9VgUEcb4/MsIT+CvZBcFmUi21rSm8uUVNSlzYy:SHb9VgJ/OTZB4fi21b8j8z3
- TLSH T1BE3423106863BCF36DED1065F5DE292A2FD8CEA141C085464773DB825AEE3D3674AF60
- MD5 SHA1 SHA512 SSDEEP TLSH