Overview
overview
8Static
static
3Kryoto-Des...up.exe
windows11-21h2-x64
8extensions...gn.svg
windows11-21h2-x64
3extensions...on.svg
windows11-21h2-x64
3extensions...fs.svg
windows11-21h2-x64
3extensions...ck.svg
windows11-21h2-x64
3extensions...d.html
windows11-21h2-x64
3extensions...ers.js
windows11-21h2-x64
3extensions...ers.js
windows11-21h2-x64
3extensions...out.js
windows11-21h2-x64
3extensions...ngs.js
windows11-21h2-x64
3extensions...ser.js
windows11-21h2-x64
3extensions...wer.js
windows11-21h2-x64
3extensions...ets.js
windows11-21h2-x64
3extensions...und.js
windows11-21h2-x64
3extensions...tom.js
windows11-21h2-x64
3extensions...rks.js
windows11-21h2-x64
3extensions...rie.js
windows11-21h2-x64
3extensions...ast.js
windows11-21h2-x64
3extensions...age.js
windows11-21h2-x64
3extensions...oad.js
windows11-21h2-x64
3extensions...-ui.js
windows11-21h2-x64
3extensions...wer.js
windows11-21h2-x64
3extensions...ead.js
windows11-21h2-x64
3extensions...rch.js
windows11-21h2-x64
3extensions...ing.js
windows11-21h2-x64
3extensions...ing.js
windows11-21h2-x64
3extensions...nds.js
windows11-21h2-x64
3extensions...ole.js
windows11-21h2-x64
3extensions...tra.js
windows11-21h2-x64
3extensions...ipt.js
windows11-21h2-x64
3extensions...abd.js
windows11-21h2-x64
3extensions...ads.js
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260911-de - resource tags
arch:x64arch:x86image:win11-20260911-delocale:de-deos:windows11-21h2-x64systemwindows - submitted
20/10/2026, 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kryoto-Desktop_0.2.27_x64-setup.exe
Resource
win11-20260911-de
windows11-21h2-x64
32 signatures
150 seconds
Behavioral task
behavioral2
Sample
extensions/ublock/img/material-design.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
extensions/ublock/img/photon.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
extensions/ublock/img/ublock-defs.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
extensions/ublock/img/ublock.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
extensions/ublock/is-webrtc-supported.html
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
extensions/ublock/js/1p-filters.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
extensions/ublock/js/3p-filters.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
extensions/ublock/js/about.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
extensions/ublock/js/advanced-settings.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
extensions/ublock/js/arglist-parser.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
extensions/ublock/js/asset-viewer.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
extensions/ublock/js/assets.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
extensions/ublock/js/background.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
extensions/ublock/js/base64-custom.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
extensions/ublock/js/benchmarks.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
extensions/ublock/js/biditrie.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
extensions/ublock/js/broadcast.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
extensions/ublock/js/cachestorage.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
extensions/ublock/js/click2load.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
extensions/ublock/js/cloud-ui.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
extensions/ublock/js/code-viewer.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
extensions/ublock/js/codemirror/search-thread.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
extensions/ublock/js/codemirror/search.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
extensions/ublock/js/codemirror/ubo-dynamic-filtering.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
extensions/ublock/js/codemirror/ubo-static-filtering.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
extensions/ublock/js/commands.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
extensions/ublock/js/console.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
extensions/ublock/js/contentscript-extra.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
extensions/ublock/js/contentscript.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
extensions/ublock/web_accessible_resources/adthrive_abd.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
extensions/ublock/web_accessible_resources/amazon_ads.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
General
- Target extensions/ublock/img/photon.svg
- Size 4KB
- Sample261020-nfcjgsbc29
- SHA256 0b82e3ed86eab3889e08027e045ec9a9acff7fcac7be5e001ac6e436643bac0d
- MD5 77f24f279b9d6cbdc6ad1461746a5c12
- SHA1 f3018ab1d7e7d0255aa8eac20f7b324a93dedeb3
- SHA512 9dc4323417709fb9b795fe144482b4fe0b2c5bbed662a5ce5e101c31994f87351823518fb75388fcff01c8fb1d7fee37611a2939a603814bfd3cc5c5b0b5cbcf
- SSDEEP 96:sja5X+3hac8tRxrDJ+tS13r5e4QBCW74EhkmRi7Joo:sh3rk7/rA7piV5
- TLSH T1FA91BEAE4BAD46EC2FD74E64D3231596336E90727171FCE16F4EA814C527D88E227C20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4352 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 1408 chrome.exe 1408 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3836 wrote to memory of 3592 3836 chrome.exe 82 PID 3836 wrote to memory of 5016 3836 chrome.exe 84 PID 3836 wrote to memory of 4352 3836 chrome.exe 83 PID 3836 wrote to memory of 5016 3836 chrome.exe 84 PID 3836 wrote to memory of 2756 3836 chrome.exe 87 PID 3836 wrote to memory of 2756 3836 chrome.exe 87 PID 3836 wrote to memory of 2620 3836 chrome.exe 88 PID 3836 wrote to memory of 2620 3836 chrome.exe 88 PID 3836 wrote to memory of 376 3836 chrome.exe 89 PID 3836 wrote to memory of 376 3836 chrome.exe 89 PID 3836 wrote to memory of 132 3836 chrome.exe 90 PID 3836 wrote to memory of 132 3836 chrome.exe 90 PID 3836 wrote to memory of 3744 3836 chrome.exe 91 PID 3836 wrote to memory of 1168 3836 chrome.exe 93 PID 3836 wrote to memory of 5068 3836 chrome.exe 94 PID 3836 wrote to memory of 5056 3836 chrome.exe 95 PID 3836 wrote to memory of 1408 3836 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\extensions\ublock\img\photon.svg1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffe4c27c728,0x7ffe4c27c734,0x7ffe4c27c7402⤵PID:3592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1896,i,120842511656591123,10523059342072224475,524288 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2168 /prefetch:112⤵
- System Time Discovery
PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,4125733955800136378,12430989044502895776,262144 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,1582924141666341281,15589634267109774789,524288 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2544 /prefetch:132⤵PID:2756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,2626205603304820324,10079072342167020987,2097152 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,10520475984356122134,16406064103447175661,2097152 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4136,i,14448258147997467318,2442339452251637847,2097152 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4140 /prefetch:92⤵PID:132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,8687096084793362924,1929215530917490078,524288 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5512 /prefetch:142⤵PID:3744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,13360201058243564588,16060951093540070057,524288 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5760 /prefetch:142⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,10903685443797044771,15311779138885863327,524288 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5508 /prefetch:142⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,1285455335502055103,7616347045988270947,524288 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5808 /prefetch:142⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5392,i,9380429096096276755,1932188702914605997,262144 --field-trial-handle=2140,i,2932709673918306121,8970383566474441252,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5812 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\418dc111-cb2a-4df3-b974-2c1524e632a1.tmp
- Size 12KB
- SHA256 adf8a268cc6adde51e536ccfd40aa0f9a35619cfeb333d2bf20a8cdfed3eb8fb
- MD5 0ea00bbc728ebe8ebab6b2cedee5dcc3
- SHA1 2d5c189f15349351ed6f6f8423753ff195caad75
- SHA512 0311718f9b5570b3f98f484c747e993b9ef6466c66d696546cf1076889d600d800eeb7e50f5e4ee2f8a960e95d3ba88b475215b35dd2ceab44d0def37f3eba04
- SSDEEP 192:vR0sRJAuZgSjT9v7ZYepAPRp2Wj9zHsb+WNnMoPzYDZ6VyIsnAUge:vR0sfAuZ99dhUXrZwTPcAe
- TLSH T1C442C72DAD55763B9CD7C22AFA627B57D6F5102630902E84E6FC8D3C14E76CC2127427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5dcda4d9-7e6d-4430-9065-fe24636e4b09.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8d8dc64b-8fe8-4f74-aac0-511b9a534cda.tmp
- Size 414B
- SHA256 6d60ab80680660b8884e275ea8ffc739e90b2098a242a7dd8e5b5ca8b0bdc903
- MD5 703bb9b57902b55655bc86027e5ab8f7
- SHA1 32ac250582d62bdccda1810c1e8a3659140ab794
- SHA512 5beca0fae6174d0751648876c835b71be0b93e6d139fbe46a7fb9ba411ec4bcaf1ef245f5c16aecb19225f7c25f298e1f86fe04e1b379cb4b8eb7701cf3fe441
- TLSH T1F2E0E59AC861ED2718FD075865904745EB40135A26A08A0F363D910C8FB423F4296C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4ef62980-e196-4ada-b8ef-4c51fd0b8c0e.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b032f80b-ca2a-434d-bed0-cca2ca4a2ab7.tmp
- Size 1KB
- SHA256 4e56918e88cbd5edd15dce1017706c5762411cb4079eb4809b34a1b2f64f843e
- MD5 42a0364e6433d7acba552dad09f9a703
- SHA1 96579004776766dc940fecd2a9c8d8e770e71f17
- SHA512 07d742b265e7c06bef50916310eddc44de6cf514618cbbc091c8b6ddd6232ffc90bacd128d4ff1fe21b5123cd2cba250e177016290b6ba67cca1e8acfb76eac7
- TLSH T125419DF793B4957E8A1192F4EB15AE1FCE690924131C3CA688D46E1B83F2872D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 e42c436edc201af6aecb5daa366817ba093b3079f9eb372a58411eba0b3d9ca6
- MD5 44e5c11447351b4a141d736c411f1ac0
- SHA1 bfcab95fd5704982ac7deed01818218ec391defc
- SHA512 18f9bd6ec36f70413aae3f58447bab93005d89f51f6def17de93c65170e1c0e4a81ffb5f6c5a6431662685d2888b89042243c9a673d9e17b905526e3d965f7aa
- TLSH T1BFB01225C8417301C41503B0115890683270CF35E113138951F00E01CA361504027218
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 5166a14a57c6b40fd89a54a85f8d7dec9f82ddf5a186d0fc916fc6d14a6dfd7d
- MD5 ba15b5442456bc5d65f22e12c6b7edd3
- SHA1 b4f3768a0661e23b184506baccbee6e8a4e41990
- SHA512 806f77fd52a446054e9264e5b08a6b2837cbacdd9b26b2266f3adaffb4e6b45edf6cb9fb513088e8d0e66aa2eebfb9cd3a9df307e519a23f8296dce50e70092b
- TLSH T169B02200C0022202C00303B0288280C83030CF30CA03030B82E00EAACCB82380022830
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c82b1247-cd3f-4829-9d98-fd0e8e8d73a7.tmp
- Size 17KB
- SHA256 9e81596c9502ad16fa07716896bf07a5c533c7a7f5b7ac02ad438a53f959d4ec
- MD5 92e564bc6ca23ed3b082dde74a24620e
- SHA1 38e5f968ba4fff9bfa62aa9e29379d1f7fa4787e
- SHA512 88325daf15d6ca22da112eb33c6aa6450c9920cbcdede45060db2dea45a6cdaa7e91e4bb379c2130a0c082c0a7be55a63f5411f19881742165ad6493c1282ba9
- SSDEEP 384:71j3W7KxkXqKf/pUZNCgVLH2HfgslsF7pLkdLceSRcXOD3y+ErU332Hw+X2dD7H4:7l3W7KxkXqKf/pUZNCgVLH2HfgsGF7pi
- TLSH T16172F8676C489E3B0FD4CACCDC267E4F9CB5014B65E9886453FA9C2903D5ACF11062EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ac08f9e0-c50b-4c34-974f-b70d18a96d0e.tmp
- Size 132KB
- SHA256 d63c3947e8847e454664301d42f41bdcc5de1bd83cfa207fa153b74e9e3fe25e
- MD5 08d76cdbdcdb40bd078ae2ddd52a068c
- SHA1 29920f61a14a7135414ade12058f26d2b7b4789e
- SHA512 9919646e2b3783328a4691609d88ad99c820fcd2a19e77ffbc6c841a083f6677a407cea8b716383201e7f8ad9045e3fe6aff6c9febb2381a458eb5bf0790b0f4
- SSDEEP 3072:MCT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:KThDxWhaj5mjie/JYFobV
- TLSH T1E6D31223ACFE01FB14BCC50840697F0086F989B3D640FFA79AD86A4F61C7EA4A357556
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b44993f8-d966-4413-abdc-7d0f55ab2697.tmp
- Size 131KB
- SHA256 2ae196ae24522bd9fe5c5e7958ae01e96a027df79c634b20a78c090bab32b851
- MD5 5476b750f5ea68f0d06aebacbff105f0
- SHA1 c55fe523dd5bee2ffe5a1d45b2f78ef075b32ecf
- SHA512 8b02fda8ebf2dbb4599aa115ddd5532ec2e5111c910805fec54fd2e6ce58f71f90d9bbc8c80d8ec016a0170b2251c74597f5f182ce0a10effa5edc184d4a42ff
- SSDEEP 3072:DT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:0ThDxWhaj5mjie/JYFobV
- TLSH T121D312239CFE01FB14BCC50840797F0086E989B3D640FFA79ADC6A4FA1D7EA09356596
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\be363d30-6bbe-473d-b900-0d7f7f565490.tmp
- Size 132KB
- SHA256 28c6ade70aacbc2b3416f9dabcee622cd2d2d66d3cf23f16f4c770dd48dae70d
- MD5 cee724470c26a48cac0cdfa9b32165cc
- SHA1 29f934c8190ebb9a84373e1454c2c0a58b1c3cd6
- SHA512 3cff893ad13bffda61f0648b658becce4391fc633dad44b17e1fdc914e7ca175316f4d3153e9d5f9d0ebefd675af674c0e30c26407ace6ca1415ee017630c1f3
- SSDEEP 3072:vD4T8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:7PThDxWhaj5mjie/JYFobV
- TLSH T1FAD312239CBE01FB18BCC50840697F0086E989B3D644FFA7DAD86A4F61C3EA49357596
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f56c5a11-31d3-4a90-837c-ff03e1c59aa7.tmp
- Size 132KB
- SHA256 5ae6ac48a42dd865811b367b365e80ebf8431992d26a761279fa24dae78f02b6
- MD5 9014a29afeea23607227568cf634e174
- SHA1 3cb96a9dee017c276ec55c5cb85716c3432490b6
- SHA512 20e7ce74300d735d7b779e3f9a18c1ee95ae71c7a1467e9aedc634b5d0271883ca96b26e5275dd0ca1bba59545be7a74e965c33a63f2bffe1d753db500b026d5
- SSDEEP 3072:vCT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXA:5ThDxWhaj5mjie/JYFobV
- TLSH T13ED31223ACFE01FB14BCC50840697F0086F989B3D640EFA79BD86A4F61C7EA4A357556
- MD5 SHA1 SHA512 SSDEEP TLSH