Overview

overview

7

Static

static

3

_08052e4a9...9f.exe

windows10-2004-x64

4

_08052e4a9...9f.exe

windows11-21h2-x64

6

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows10-2004-x64

4

LICENSES.c...m.html

windows11-21h2-x64

4

YouTube Desktop.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...er.dll

windows10-2004-x64

1

resources/...er.dll

windows11-21h2-x64

1

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-21h2-x64

3

resources/elevate.exe

windows10-2004-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...op.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/05/2026, 10:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    YouTube Desktop.exe
  • Size 180.3MB
  • Sample260519-meastset3m
  • SHA256 108b1135b4c25b0b82f916a0e8cccd1399253c3e0fbc2c245b19975a8950000b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
    "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
      "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1916,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
      2⤵
        PID:2460
      • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
        "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --field-trial-handle=2320,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
        2⤵
          PID:3888
        • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --app-user-model-id=com.ytdesktop.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2680,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:1
          2⤵
          • Checks computer location settings
          PID:3836
        • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --app-user-model-id=com.ytdesktop.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3064,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
          2⤵
          • Checks computer location settings
          PID:4848
        • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --app-user-model-id=com.ytdesktop.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3616,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
          2⤵
          • Checks computer location settings
          PID:4632
        • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --app-user-model-id=com.ytdesktop.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3060,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
          2⤵
          • Checks computer location settings
          PID:1532
        • C:\Users\Admin\AppData\Roaming\@yt\desktop\GPUCache\elevate.exe
          C:\Users\Admin\AppData\Roaming\@yt\desktop\GPUCache\elevate.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4896
        • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --field-trial-handle=2252,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
          2⤵
            PID:23732
          • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
            "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --field-trial-handle=4216,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
            2⤵
            • Modifies registry class
            PID:24384
          • C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe
            "C:\Users\Admin\AppData\Local\Temp\YouTube Desktop.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\@yt/desktop" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3188,i,16840463158977930306,14745121151125152338,262144 --enable-features=PlatformHEVCDecoderSupport,UseOzonePlatform --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:6124
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x240 0x454
          1⤵
            PID:116

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Code Cache\js\index-dir\the-real-index
                • Size 48B
                • SHA256 fc9af0f296c62004b11d05879d30276007efe2e2e10c3bf54764a735f9033668
                • MD5 SHA1 SHA512
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Code Cache\js\index-dir\the-real-index
                • Size 528B
                • SHA256 aa6c26ea30cd26def2195a2554970bdad4e9851f404280f0168b766bcbf20e7a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                elevate.exe
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\GPUCache\elevate.exe
                • Size 105KB
                • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Network\Network Persistent State
                • Size 2KB
                • SHA256 5eec331f86ab051433b0c187b2722dae9492c364554254496a2800ca46dad048
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State~RFe5969eb.TMP
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Network\Network Persistent State~RFe5969eb.TMP
                • Size 59B
                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Network\TransportSecurity
                • Size 691B
                • SHA256 02f66b90f648716bd324d0ada3c5e1349fa065e0cea8dee72a3bf7dfd83b263e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity~RFe58ada0.TMP
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Network\TransportSecurity~RFe58ada0.TMP
                • Size 357B
                • SHA256 903831e75624413d951afee126fae789b55247a673e4b05a675cf055d07b485a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Preferences
                • Size 161B
                • SHA256 004d1844a82a6fa3a95f8e69a81f7d911c9a95bf3fd1e41e045f1be02cd4e0c7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Preferences
                • Size 86B
                • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                index
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\bdb08b94-09d8-47dd-8c39-bdbaab0cea7f\index
                • Size 24B
                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                • MD5 SHA1 SHA512
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d1502612-8e63-4638-bb84-a48990068a67\index-dir\the-real-index
                • Size 2KB
                • SHA256 83d30fe2ca62c0bd4fd9999fd96a0514de2ace281e0167aaacec3d0835bfaeab
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                the-real-index~RFe58d8a8.TMP
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d1502612-8e63-4638-bb84-a48990068a67\index-dir\the-real-index~RFe58d8a8.TMP
                • Size 48B
                • SHA256 fe2608bf086e360b35ad9bf6463155e9028c4f620ce52abc40598e25a58ebe0e
                • MD5 SHA1 SHA512
                Submit Download

                index.txt
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                • Size 114B
                • SHA256 131e3505c7eb68ed42d8d535541b775ee27c421f270b1cb571e7729508fed63e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                index.txt
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                • Size 176B
                • SHA256 0f70ff7108a0b3c8a9c87574e8dd3671b494b439d2df95e9a3f69b6595d9511d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                index.txt
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                • Size 112B
                • SHA256 03cd7c1c8f3e07f4b0810dfa21d3bb39ccdaa17b8059060d7ee02226f5f61d11
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                index.txt~RFe587942.TMP
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe587942.TMP
                • Size 119B
                • SHA256 4e62114bb8e6758c3f72fb32887754c40e645f5a731952c5232837ae5d4849c2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MANIFEST-000001
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\Database\MANIFEST-000001
                • Size 41B
                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                • MD5 SHA1 SHA512
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\ScriptCache\index-dir\the-real-index
                • Size 72B
                • SHA256 bebf68bf883fba689b5a8543c0ec0ac4c9b0e65e3930ca14cfa9cd6f4e359f0c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                the-real-index~RFe58d712.TMP
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d712.TMP
                • Size 48B
                • SHA256 9f78e8d514517f6ec4bb63298245c79b273a7b537bcd8129def6179ad6995c4b
                • MD5 SHA1 SHA512
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\Session Storage\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                settings.json
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\settings.json
                • Size 1KB
                • SHA256 0badc1c377a13cabee3605b7ccde641221ff9d4917f8fe31c0b03a85047d7034
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                settings.json.tmp-922656735308a386
                • Path C:\Users\Admin\AppData\Roaming\@yt\desktop\settings.json.tmp-922656735308a386
                • Size 1KB
                • SHA256 07da3096d752fdfe18bdcd7462b9b215bb8045af41ef4fdcbf0ac5caa5f259ed
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                default.dic
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512
                Submit Download

                memory/1532-5298-0x0000023470B60000-0x0000023470B90000-memory.dmp
                Download

                memory/3836-4993-0x0000016749BE0000-0x0000016749C10000-memory.dmp
                Download

                memory/3836-68-0x00007FF8352E0000-0x00007FF8352E1000-memory.dmp
                Download

                memory/3836-67-0x00007FF835280000-0x00007FF835281000-memory.dmp
                Download

                memory/6124-5378-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5377-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5376-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5388-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5387-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5386-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5385-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5384-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5383-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download

                memory/6124-5382-0x0000016D12170000-0x0000016D12171000-memory.dmp
                Download