455dad9431384dce6ef771bd1efa828371ddd1ba5df903f0235e09da8edf3b7c

Resubmissions

18/07/2026, 22:34

260718-2hctxsev2q4

18/07/2026, 22:30

260718-2e69cshs2x3

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Krypton-1.21.11+5.1.1.jar
Size 1.8MB
Sample260718-2e69cshs2x
SHA256 455dad9431384dce6ef771bd1efa828371ddd1ba5df903f0235e09da8edf3b7c
MD5 bb99525090ea777cf188aa640cdf2ac4
SHA1 cbc66bb65e6b3a5523fb2da697fe64016e87ddea
SHA512 f41856f8345441b5f7ae18c795c8e7dea015a89332559da6eacd24f953aaec97fa7b6aa4989ccc6a956a33d84de40746e1c77087907d2330ccf733b2e25157ea
SSDEEP 24576:HErH9avJAfwBxn5vr6abQj/P9ajx+mNBHM2zr3xrmzdDseJiWQW7QTOhctjSb9Kt:HErHmV+eBH9VHNHW+yctyQuW6c
TLSH
T10C9533E4A9C15DBBE053B377405CEE427D1CAA5A7229053F75EEA08DC998C871B0B378
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2784	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288874987110290"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 2396	4384	chrome.exe	102
PID 4384 wrote to memory of 3728	4384	chrome.exe	103
PID 4384 wrote to memory of 3728	4384	chrome.exe	103
PID 4384 wrote to memory of 2784	4384	chrome.exe	104
PID 4384 wrote to memory of 2260	4384	chrome.exe	105
PID 4384 wrote to memory of 2260	4384	chrome.exe	105
PID 4384 wrote to memory of 3360	4384	chrome.exe	107
PID 4384 wrote to memory of 3360	4384	chrome.exe	107
PID 4384 wrote to memory of 4856	4384	chrome.exe	108
PID 4384 wrote to memory of 4856	4384	chrome.exe	108
PID 4384 wrote to memory of 1736	4384	chrome.exe	109
PID 4384 wrote to memory of 1736	4384	chrome.exe	109
PID 4384 wrote to memory of 4620	4384	chrome.exe	110
PID 4384 wrote to memory of 4620	4384	chrome.exe	110
PID 4384 wrote to memory of 3552	4384	chrome.exe	112
PID 4384 wrote to memory of 740	4384	chrome.exe	114
PID 4384 wrote to memory of 740	4384	chrome.exe	114
PID 4384 wrote to memory of 5068	4384	chrome.exe	115
PID 4384 wrote to memory of 5068	4384	chrome.exe	115
PID 4384 wrote to memory of 3364	4384	chrome.exe	116
PID 4384 wrote to memory of 1464	4384	chrome.exe	117
PID 4384 wrote to memory of 3848	4384	chrome.exe	118
PID 4384 wrote to memory of 968	4384	chrome.exe	119
PID 4384 wrote to memory of 968	4384	chrome.exe	119
PID 4384 wrote to memory of 3920	4384	chrome.exe	121
PID 4384 wrote to memory of 3920	4384	chrome.exe	121
PID 4384 wrote to memory of 3604	4384	chrome.exe	122
PID 4384 wrote to memory of 3908	4384	chrome.exe	123

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Krypton-1.21.11+5.1.1.jar
1⤵
PID:1416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe381bc728,0x7ffe381bc734,0x7ffe381bc740
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,392538649899326644,7925574324157510113,262144 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,13365631751957773710,17883326865787585184,524288 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,13571602615645805837,2646220909828427488,524288 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,3397744236862805341,3884574480244807114,2097152 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3464,i,2290766516124202588,1711966971575700950,2097152 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,13124463586202188941,5944828327084830894,2097152 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:2
  2⤵
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,4980778104661975161,12638787424289164270,2097152 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,4115834288871136730,17586979064140357024,524288 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=6076,i,18308890487993725806,14793926656011809961,2097152 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3600,i,6490293720401036082,2521759668751485316,2097152 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,15021401414466631245,2763216563705641903,524288 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3504,i,5875533910477864034,9494203177183505717,524288 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,10218111950836290742,7423532124138918500,524288 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3624,i,5781501214424097470,13284729443393551526,2097152 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=1216,i,411470273052145544,13396630330190825104,2097152 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,12816649520084005636,420407460034080592,524288 --field-trial-handle=1952,i,7544251901355768452,922261496713754457,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\krypton-1.21.1-v15.jar"
  2⤵
  PID:3908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 184161d39ea8d04bdb25511dcdf734e68809083dde227bbbcb03c476321e9476
MD5 e3765eb59f8d2ae7d29c644a3ec13b0b
SHA1 e486bc03e73604ee114e4c47f5da4076fb91eb34
SHA512 5d7dcb68aa77005ed352856d146db04197bf0ad9451bc2786a8967abc21b875022e4e29f6b74bb3f61461072a0b71451d6eb195625ca29f37ccb5fce1c277e98
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 53bd56c8d30fcfde1aa6a41f8b01b809f375fa3c138fff1bad57eb763ff93e7d
MD5 354b1616f4ef0588010b4a2f4e48ea0a
SHA1 32ceb765b448a14c8706fa565898b369176e4977
SHA512 d11936227c9ca8ebca2b9c70ac62cb417c1df739c06cbfaea79bae6be59dda1898f8080f84289c4d888b3db8b2cd7b7b6458a96e33d73e7606cf7e669c7fc0d0
TLSH
T178E02B79C962AC3719F8172874654745E65113176750980F773D920C4FB473A418789C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 6caf354a7855e2ba32a3994a94b5257db4a9d2e08660c91ca14310c54ed78ec7
MD5 57e8bd4f26396b6909a6d35e6efe28af
SHA1 87219f6d834622881779dffaceff359e5dbf9f4b
SHA512 2fd2ecc9d6c88cbbe3440e9c6d6d341f98771caa3cb7e31c72775cd788fe058c5d63181ded598f14fe2210deb87386e17bd5295f8fa56049ede223252bf26a60
TLSH
T1DC11943922E398B1CFE90439D5821C9974610CAC4B03326A23838B3BB76F5F00454CA4
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7f12f3ed128aeb6433c74b4c3dd5923142b5488f49ad7ae776b6f714269320a1
MD5 3003579ab3db0e65cbc2ff362c8b80dc
SHA1 06951c25de1a215cbfcd0a2cb960aaefe71df75c
SHA512 0153544eb86099981a82d059e19b347b45757cf1d218005e6360e6a96806045e58f47d7a956dc042e91864cac5c950dc7c7be60041b1c9add43f234e338b3c6f
SSDEEP 192:DlizGnY+JEJ14gaaiunFoUii0aPiv+fPzNPjIH3IBhlMDS2vFb:DlizGnY+JEJ14gaaiunFoUii0aamfLNy
TLSH
T1E802CFF7C3D8852D891156F8EB25BF1FCE291A18432C3C26C8D9AF5B93E2871D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9afd9a6c0ec21aec7a964fb96d6cd05c5415df25005db72a51a453837982e1ee
MD5 53b21f8db6acd1afc3fb745821c069e3
SHA1 15dae43b4fb362ad858abf26e52b14abd2dcbb4d
SHA512 a243594f60cf7465481c3e1c8421f8bb288c8cb45b7d091b4c289f0c2a0ffde2235814251ec762d39e42db71271a650423676bfd4a9c9f888781888dfe852cc0
SSDEEP 192:FRbbuE02g9h39v7MF+pAPRp2S9HHsb+WNn3E0J2/5kwsrVyIsnAUgtaJ:FRbbU229goUX91wU0kxA8
TLSH
T1B942E72EAE116D7B6CDAD229FD227B53D7F5103162D52E84EAFD8A1C14E76CC221700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1591c796ca88e63495b7cfc19a880bf69f29c80b7d70b8831d65ef3ff90535e9
MD5 8318a29d44d0eb75850f9c5b9068f57f
SHA1 c20c9f5d451b409244d74b7319bf64485a5653c6
SHA512 7c379af61545777c154cbe95f1c5b4d00f8c02898c05b8346fc04476e27aa74acb9f9fc85b885da387b91251949e740f460e36cfbe0063ba908877802b333929
SSDEEP 192:FRHcBzHuE02g9hk9v7MF+pgPRpuz7dxv9HHsb+WNmh3EMyp9+CRYK2/5kwjrVyI6:FRHmzHU2B9gocXy71w1MOlYVxhe
TLSH
T16762D56BAD106E776CDAD229F912BB57E3F1103262D41E84EBFD8A1C14E76CC221704B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 dc7d87bf366803151cd910083ae110659a29af4171ad3b10569bd7f6f229eab5
MD5 24abfb7c54f559fa083b0d96e0bc07b2
SHA1 b795aaf69dea5fe12a564274ec43a7fa5096d8e8
SHA512 e7d07fbdd843e9bbae40a8eae1a3dc0cd0902b43f3d90af8c5e8a9940cd6e551d3aef07b0fc47c72f2459370d4024af2ebaeed9f019baaf3a21fc93c01ff3d02
SSDEEP 192:FRHcBzbuE02g9hk9v7MF+pAPRp2zJv9HHsb+WNn3E4nM292/5kwsrVyIsnAUgtaJ:FRHmzbU2B9goUXo1wUb2gxA8
TLSH
T16A52C52EAD106D776CDAD229FD22BB53D3F5103162D52E84EAFD8A1C14E76CC221B05B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 aa6588057a99d4ce68bb1e7ea83ef6957d2940ba1c27c0c0669824c4a7895437
MD5 32a319e9ecec8b51c048a5063f5758b3
SHA1 7692376b81cf5ef9bbdd5b13dfad3727f3218d38
SHA512 9e97b27d155f4991d21f07f8fb8feb08246072cc7e0e946055a1a72791a0fdca77ab22df72870b3499a5185f43e3a625af28f63f9ef7427666d9f69ff3ece13d
SSDEEP 192:FRHcBzHuE02g9hkov7MF+pgPRpuz7dxv9HHsb+WNmh3EMyaiMCRYZ2/5kwjrVyI6:FRHmzHU2B0gocXy71w1MqzYUxhe
TLSH
T12962D66BAD106E77ACDAD229F911BB57E3F1203262D41E84EBFD8A1C14E76CC2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2eff7d109423137b52be960963adaae0afa8d954ceecb9fa3c2f535f38c6f6fd
MD5 493f4754fb440d0e8b926b6f110aec31
SHA1 4c16fc2bd28baec58021b9ef964616f2f46b7d68
SHA512 42529a426efe330f62e9b54b0abd416a048ebafd338c71b040a6458a821badf335e18e16d3224b2292d46d3ce7c64477c2334437f098de98d020b39a3b221a6b
TLSH
T17DB01241C0029AC1C00307F415422A88B11EEF11970A670143F06922CC351908225051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f940.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f940.TMP
Size 96B
SHA256 0194335ac9211b4cb60ef8dd3514970e56d1000d09ec3d5e2096de403177d65e
MD5 74c120d8f4277a353c78f26446547397
SHA1 096756cc07ddce64cd5e1373d4768e0b81c6bb4d
SHA512 4f3fbf2e702b2e6e6c6e76d68211faf3733344c91793ace8a1c7153241b78aad432b032f849bbb591ffb7bb0758c410b6c5cbb8bfdd38c231bc02aa47ab6c062
TLSH
T196B02200C002A302C00203B03882E0F8F020EF30C3033303C2E80A22CC222300032828
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9e0b68718bd4d5e0028bb01d7d74759d939f1c47b98cf3ce86a6b59a3518bf0f
MD5 822cf0de9c4ce9b7f84aff7d7bf8ec2a
SHA1 00b852aaf39dc8aa8ce35eb832203b466b32fe16
SHA512 be9dc56274475a547c71208cfe4312391f8167fbfdc09c4bbbdd7838b0d492b2bd0e9a2e0c08ab76e1b103a79d00f18315d840b33b3714638029802ce14a2db8
TLSH
T1AEB002B409431957CB1453B117D109A437214DA437F2E67788E6BFA89865BD36323B51
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 91c816e4f3b6fce5298c98d591fe7718ec80fae76a7c4a4bc02af252990f4c0f
MD5 80124a887c8dbb70135c396d6b10a036
SHA1 75b4ac6ad59710cd99d01ef5591bb23cffa3f507
SHA512 0fe17176e505ff9ea0c5126b47b71a528e8e3e03e77c4b6d57f21e55b9c654579d121bcd53f00f36b9eba9be685887938ca4e849d06b945bfc53dd72f81af290
SSDEEP 6144:WSik4RlER6EtbaSgZoh0KepeBf2LOm7Rkm1tYpBeh2BAoS:WSiHERLa3KYeW9oBGcAoS
TLSH
T1D134233AEC39FD36796DA75EB08E3B1F5A70C1B2ED69A4D6C5A46604B3F4BC90404834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 d156e55ee6e9ff6f0a9e4bc2cb711b574d672813a1d17dec6331c2f46e402336
MD5 dd4bbbc137f6335189119f3140dc746a
SHA1 ea323e76df60b6e4100b1f9ad3e0c43a17e0d984
SHA512 61cc654bea50b33b4620a94848a00c1be62a5463d2a1037534cf232825398ff93771ff69ea696230a9a0deddb71afbb6ab5b98337e3edc7360fc2dc89f85e761
SSDEEP 6144:rNLik4RlER6EtbaSgZoh0KepeBf2LOm7Rkm1tYpBeh2BAoS:rBiHERLa3KYeW9oBGcAoS
TLSH
T18C34123AEC35BD367D79AB5EB04E371F1EB0D6B3D96994CAC4A46604B3F96C80804874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 00dbcf7c3a301ee90fcfd42b07358ebfeb7a8bcda3aedd322861deb21f791129
MD5 f2a877a36c0b87dfbbb3a76533d2fd42
SHA1 6c470d996147b32b8e73510313d5d01996058646
SHA512 bbcbc5eaa3880d306cb746d41e317469264b91a587042faae73e27982b23fd2ef7fd9ee7854262f0d0d2516e34b32431d215d69b182bf2278bdd169b8fc2b8b6
SSDEEP 3072:/KGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/Nm7Rkm1tYpBeh2BAoM
TLSH
T1AAC312275E75E8375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 ec3b71aea806923a68b14491779af6462774905c8573eb0207222c2f1e9009f4
MD5 7c30e4b805ea4d55ac3ddef50c40f567
SHA1 d22c95db6a5139fd2e118478c4efcebf6b530c52
SHA512 972901676ac7bb127b8f061b5ffd2e875408cadfff61c119573bd7df15f7ad8f9cfe2e5535b8589f8f4e6933816897d27346b443be7406b3c51bf0605fa1f81d
SSDEEP 6144:rSik4RlER6EtbaSgZoh0KepeBf2LOm7Rkm1tYpBeh2BAoS:rSiHERLa3KYeW9oBGcAoS
TLSH
T1A834233AEC39FD36796DA75EB08E3B1F5A70C1B2E969A4D6C5A46704B3F4BC90404834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krypton-1.21.1-v15.jar

Path C:\Users\Admin\Downloads\krypton-1.21.1-v15.jar
Size 654KB
SHA256 b2173196d06aa3458bb0c80b6c3ca5b73c1f9f2ee825f0b5f853d46a59e486eb
MD5 f504d57ba65f46465c28ba3ccbb101b1
SHA1 0827b2399446ad2ee75ffdf9ed2b7373f825e9ed
SHA512 1b428aa2188da19c0f3332927d82fbe684158db2dad69267776481e151fa700d188ad18b33c6751987a60c441c98280952ebd0fef269bbb17b9e72f60f8a111a
SSDEEP 12288:h+jc3qYR4KDdgaRQSFVK4wlMwwceiDXHPYL+H7bAliu3IBYJlvjKP+p2PtIu/hLy:v3DgaCP4wlMQVDXAL6bAlN3IB0dKP+pz
TLSH
T165E4020C3FA8C565D3ABD47A58445AD7B88C40DC663ADA1785B828CAC4DD889F742FCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-12-0x000001D080000000-0x000001D080270000-memory.dmp

Download

memory/1416-2-0x000001D080000000-0x000001D080270000-memory.dmp

Download

memory/1416-11-0x000001D0FEB40000-0x000001D0FEB41000-memory.dmp

Download

memory/3908-285-0x0000029080000000-0x0000029080270000-memory.dmp

Download

memory/3908-295-0x00000290FBDD0000-0x00000290FBDD1000-memory.dmp

Download

memory/3908-297-0x00000290FBDD0000-0x00000290FBDD1000-memory.dmp

Download

memory/3908-298-0x0000029080000000-0x0000029080270000-memory.dmp

Download