Overview
overview
8Static
static
1Oracle_Vir....14.gz
windows10-2004-x64
1Oracle_Vir....14.gz
windows11-ltsc_2024-x64
1Oracle_Vir...14.tar
windows10-2004-x64
1Oracle_Vir...14.tar
windows11-ltsc_2024-x64
1ExtPack-license.html
windows10-2004-x64
3ExtPack-license.html
windows11-ltsc_2024-x64
3ExtPack-license.rtf
windows10-2004-x64
1ExtPack-license.rtf
windows11-ltsc_2024-x64
1win.amd64/...el.inf
windows10-2004-x64
1win.amd64/...el.inf
windows11-ltsc_2024-x64
1win.amd64/...in.dll
windows10-2004-x64
1win.amd64/...in.dll
windows11-ltsc_2024-x64
1win.amd64/...VM.dll
windows10-2004-x64
1win.amd64/...VM.dll
windows11-ltsc_2024-x64
1win.amd64/...el.cat
windows10-2004-x64
8win.amd64/...el.cat
windows11-ltsc_2024-x64
8win.arm64/...in.dll
windows10-2004-x64
1win.arm64/...in.dll
windows11-ltsc_2024-x64
1win.arm64/...VM.dll
windows10-2004-x64
1win.arm64/...VM.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 12:34
Static task
static1
Behavioral task
behavioral1
Sample
Oracle_VirtualBox_Extension_Pack-7.2.14.gz
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Oracle_VirtualBox_Extension_Pack-7.2.14.gz
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Oracle_VirtualBox_Extension_Pack-7.2.14.tar
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Oracle_VirtualBox_Extension_Pack-7.2.14.tar
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
ExtPack-license.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
ExtPack-license.html
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
ExtPack-license.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
ExtPack-license.rtf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
win.amd64/VBoxExtPackPuel.inf
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
win.amd64/VBoxExtPackPuel.inf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
win.amd64/VBoxPuelMain.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
win.amd64/VBoxPuelMain.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
win.amd64/VBoxPuelMainVM.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
win.amd64/VBoxPuelMainVM.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
win.amd64/vboxextpackpuel.cat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
win.amd64/vboxextpackpuel.cat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
win.arm64/VBoxPuelMain.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
win.arm64/VBoxPuelMain.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
win.arm64/VBoxPuelMainVM.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
win.arm64/VBoxPuelMainVM.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ExtPack-license.html
- Size 10KB
- Sample260818-prvpwasdnb
- SHA256 d323942ce5115ec94f0c400818935883865212a7885696d010d00ca51eca5d41
- MD5 e5c315881ceb72a6188cdbda4517ec1e
- SHA1 ff3a623e1dcfad6f03e4af51718a2af3e29aa4ad
- SHA512 6fc81ee5121db08d0ba4950009bab91a8426d022fdf2e390a13d9332f2d5781e3bc52ece47338e538a709cf8843fd1826f9b6540180bbfae3074fc1a3f6c3ace
- SSDEEP 192:qLayy8KgvxJI3XThbH+cDlprVjcgd3404ErXC6xoe0yDGpRpP7ixYU:Caz8KgMHTbprVj40rk0DGBGH
- TLSH T17D22D9E7B34827A11787037A36478FD5F369883D76BF451020A5C11A2762D7883BF6AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5644 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315301960386898" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 1564 chrome.exe 1564 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe Token: SeShutdownPrivilege 5456 chrome.exe Token: SeCreatePagefilePrivilege 5456 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe 5456 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 5456 wrote to memory of 2096 5456 chrome.exe 85 PID 5456 wrote to memory of 1276 5456 chrome.exe 86 PID 5456 wrote to memory of 1276 5456 chrome.exe 86 PID 5456 wrote to memory of 5644 5456 chrome.exe 87 PID 5456 wrote to memory of 1268 5456 chrome.exe 88 PID 5456 wrote to memory of 1268 5456 chrome.exe 88 PID 5456 wrote to memory of 848 5456 chrome.exe 90 PID 5456 wrote to memory of 848 5456 chrome.exe 90 PID 5456 wrote to memory of 2324 5456 chrome.exe 91 PID 5456 wrote to memory of 2324 5456 chrome.exe 91 PID 5456 wrote to memory of 1856 5456 chrome.exe 92 PID 5456 wrote to memory of 1856 5456 chrome.exe 92 PID 5456 wrote to memory of 1108 5456 chrome.exe 97 PID 5456 wrote to memory of 6104 5456 chrome.exe 108 PID 5456 wrote to memory of 4328 5456 chrome.exe 109 PID 5456 wrote to memory of 4112 5456 chrome.exe 110 PID 5456 wrote to memory of 1564 5456 chrome.exe 118
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\ExtPack-license.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcea44c728,0x7ffcea44c734,0x7ffcea44c7402⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,13679707403172233330,12615575922926532801,262144 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,16645790173973691657,3611676956811559223,524288 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:32⤵
- System Time Discovery
PID:5644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,18025319922368581290,6104920293998014174,524288 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:82⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,16542348420597696882,10376492765434071695,2097152 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,8885446170160113773,11983833449049611648,2097152 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3836,i,6246071825865290306,5640180576211276853,2097152 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:22⤵PID:1856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5252,i,2542412413787966394,12981644212332333104,524288 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,13222380196985172835,18119629788936981202,524288 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5388 /prefetch:82⤵PID:6104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,12256373161107061145,9825737499448342327,524288 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,12933543228608670059,7386504733451060725,524288 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:82⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5148,i,5673111928702000876,15517987111250030082,262144 --field-trial-handle=1996,i,3685751804560785339,9879004608134732632,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1564
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 964ff534830e35f9c23e3ac238cc24c6641497a579230a338243512e764ba1c9
- MD5 3d90a3a19be670a3ebc2758177932c6a
- SHA1 bb9fbf4267a06249eb78ef0f5aaa7effab3f54fc
- SHA512 4de8e0d9dc7a019eecb7621c5eb3e52497604987c6cc1ae62d0c8eac1234b4a0eca00fa590b6df89e4c011de89a2de2a86af4f8ed86c74a8ee660a376446b9fb
- TLSH T1AFE02BBEC962EC371CFD1B1D94544785E655534B3A40848B3E3C85194F7523E824A85C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 4e5dc142f6af3939d35a4ee324a06299361f4e9b44bc75c5c87894914efc25ba
- MD5 250c576bbe5243b5ad174bbe6fb735b6
- SHA1 224172f408a70f1cdfde63814a3848cd21c20862
- SHA512 eaaa6de65536d534e05c2dc8c77c8190766542ec25cbf7a4331a926401830f8a528aa51cf66b5ea679bb3ac9894fb37cb7b64daaad8ab24ec67c124bb80b5dec
- TLSH T124419BF793B4997E8A1192E4EA156F1FCE790524031C3CA688D46E2B83F2872D10178F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 af1737b4e1ffb5647505b533fbb8d2cd5d5913f359840a36454cf3c12540ce30
- MD5 29a3c5de39526e14019b6d932404a21b
- SHA1 696a3b8284db0b3465c12c395319fa7ab716b1b2
- SHA512 ec8237d112b4a17fb995608b28cf22a05af8613927c631925c66ece3695a9e96b11f2ecabcc48f06cb70839d20633a16dbe9bd955dfaeee69521b7695ba8ab8c
- SSDEEP 192:5R5Rng/A8vn7aWtZ/v71hpAPRp2OQ92Hsb+WNnxI4PQlhaAXl8VyIsnAUge:5R5R+jaWtZXBhUX4Qwx3PYaVe
- TLSH T1B342B52EA915697BADCBE22AFD213B53D7F5102520E42EC4EBFC892C15D75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 5a3ecd27adda11c29dbacb4cfbe46a10cfdabd5adc43d1c923909ffeac75a7bf
- MD5 fdb182bb16a10872aae33c9297a917dc
- SHA1 6cf8f3bc97f55a9d6a74e96cffa43d2cca5f334b
- SHA512 7c959e8ac7c3c6c16ce91519d52c3847bfd56f54606052e798ed061e7bee9fe96512333659d80fa454d8b825b77680c76552831b021788beba83b9c1d57ff466
- TLSH T140B01242D002A112C45203F41143688872195F149A0E270243E07D23CC35171D114050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5891fa.TMP
- Size 96B
- SHA256 cc8b3d9e11ed448e9d87c01296b3d21721d85ec1ba85d012577158ec13b933b7
- MD5 5dab61bbe8880be58c4e3a1ab553246f
- SHA1 825f4b9c44a851756e84ce8f364ed2eb5d041e2a
- SHA512 8e2ea5077ec2c04c5719ed6f61a62bc6c1288535e0c48064424e9f89a45474a7d4eb6bd880c058b3780065cf383da0634baa7ea0063f42c642de1430e05e51d4
- TLSH T1EBB00256C602A326C45317B0259D96D872E4DF2AD6031316E2E02A7BDC296715636170
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 be6bfddc1504deb677300d60ee35901a678f9605ebd94780e519846aa8459af2
- MD5 faed69779946650cda1f295bb43f96e2
- SHA1 0d87cbd07d6eff05048991c21317a37e05ce07e8
- SHA512 6c6a6d5aa17ca77a8bbee2f07e2d8a1637d5a18f3856f6c04671ba032d21ef3ce48e4bd0fc1dd6083cbb2a54cd2206b3b590ab47810a280691bf6445b08d0583
- SSDEEP 3072:TGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:qm7Rkm1tYpBeh2BAo3
- TLSH T121C312275E71A9375D79BB0EB08E0B1F1EF14AA6C930DE92C8D85A0437E97CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 6a2468bef57c010cb50d38f4fca5d236bff638d8911a7688a2466eceb3d3b100
- MD5 cfcf362ef4eeb8b6ce086b746698e235
- SHA1 cbf50a64c6ebd07a0a17bb116208ef71170057d6
- SHA512 77c9bab596b5d8cdc376056b33953c019bd005d1650b4444ab005e99a649848a7a10588f7408138e2fc8ba84daf8ed9be6a92e283b3b36803e79470ccd6aea42
- SSDEEP 3072:HGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:mm7Rkm1tYpBeh2BAo3
- TLSH T140C3123B5DB5A8375DA9BB1EB04E0B1F1EF149A7C930DE92C8D85B0423EA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 e6924aa6fe3e6d7581e1ad5fe5b0adc77395f2c4bb5ce716fba5226cf2e5f44e
- MD5 b757d18488446aa2dc996526cc5731a1
- SHA1 9fc33613588a41fe3132d45338cf60d9431875c5
- SHA512 6730a74d50668efb602eb45904b3375bfe3fa7c9d5d1c14affd2ce78deab5c697698272858386d456cb33b006d15c395c01c6468a2ef920463c4d31908ae6297
- SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:rm7Rkm1tYpBeh2BAo3
- TLSH T1ECC3123B5DB5A8375DA9BB1EB04E0B1F1EF149A7C834DE92C8D85B0423EA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 149KB
- SHA256 6d55b737cfa3d83f99e07ead8768de8a25bee0dfdf347ebff575bdaf2a919744
- MD5 8f46553074c10c6b221cd40efe84f096
- SHA1 d279c567e5e839b20639caa34fc71c55e46a4678
- SHA512 4c752aeb522617fed15391ae738dfc7e03f4d6e1629f78a5ae68456b24be0d0843c20d424f22a17d88afdc2dd1efc186df19ff298de095a7cebc824997b0ba38
- SSDEEP 3072:tU5R08yRftlwcdJQGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:t580fjwsJbm7Rkm1tYpBeh2BAo3
- TLSH T192E3126B4D71A83659F9B74DB48F0E0E0EF25EA6CE24DA97C8C51F0427A86CD0B45E34
- MD5 SHA1 SHA512 SSDEEP TLSH