Overview
overview
8Static
static
3Kryoto-Des...up.exe
windows11-21h2-x64
8extensions...gn.svg
windows11-21h2-x64
3extensions...on.svg
windows11-21h2-x64
3extensions...fs.svg
windows11-21h2-x64
3extensions...ck.svg
windows11-21h2-x64
3extensions...d.html
windows11-21h2-x64
3extensions...ers.js
windows11-21h2-x64
3extensions...ers.js
windows11-21h2-x64
3extensions...out.js
windows11-21h2-x64
3extensions...ngs.js
windows11-21h2-x64
3extensions...ser.js
windows11-21h2-x64
3extensions...wer.js
windows11-21h2-x64
3extensions...ets.js
windows11-21h2-x64
3extensions...und.js
windows11-21h2-x64
3extensions...tom.js
windows11-21h2-x64
3extensions...rks.js
windows11-21h2-x64
3extensions...rie.js
windows11-21h2-x64
3extensions...ast.js
windows11-21h2-x64
3extensions...age.js
windows11-21h2-x64
3extensions...oad.js
windows11-21h2-x64
3extensions...-ui.js
windows11-21h2-x64
3extensions...wer.js
windows11-21h2-x64
3extensions...ead.js
windows11-21h2-x64
3extensions...rch.js
windows11-21h2-x64
3extensions...ing.js
windows11-21h2-x64
3extensions...ing.js
windows11-21h2-x64
3extensions...nds.js
windows11-21h2-x64
3extensions...ole.js
windows11-21h2-x64
3extensions...tra.js
windows11-21h2-x64
3extensions...ipt.js
windows11-21h2-x64
3extensions...abd.js
windows11-21h2-x64
3extensions...ads.js
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260911-de - resource tags
arch:x64arch:x86image:win11-20260911-delocale:de-deos:windows11-21h2-x64systemwindows - submitted
20/10/2026, 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kryoto-Desktop_0.2.27_x64-setup.exe
Resource
win11-20260911-de
windows11-21h2-x64
32 signatures
150 seconds
Behavioral task
behavioral2
Sample
extensions/ublock/img/material-design.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
extensions/ublock/img/photon.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
extensions/ublock/img/ublock-defs.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
extensions/ublock/img/ublock.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
extensions/ublock/is-webrtc-supported.html
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
extensions/ublock/js/1p-filters.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
extensions/ublock/js/3p-filters.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
extensions/ublock/js/about.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
extensions/ublock/js/advanced-settings.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
extensions/ublock/js/arglist-parser.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
extensions/ublock/js/asset-viewer.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
extensions/ublock/js/assets.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
extensions/ublock/js/background.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
extensions/ublock/js/base64-custom.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
extensions/ublock/js/benchmarks.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
extensions/ublock/js/biditrie.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
extensions/ublock/js/broadcast.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
extensions/ublock/js/cachestorage.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
extensions/ublock/js/click2load.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
extensions/ublock/js/cloud-ui.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
extensions/ublock/js/code-viewer.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
extensions/ublock/js/codemirror/search-thread.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
extensions/ublock/js/codemirror/search.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
extensions/ublock/js/codemirror/ubo-dynamic-filtering.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
extensions/ublock/js/codemirror/ubo-static-filtering.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
extensions/ublock/js/commands.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
extensions/ublock/js/console.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
extensions/ublock/js/contentscript-extra.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
extensions/ublock/js/contentscript.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
extensions/ublock/web_accessible_resources/adthrive_abd.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
extensions/ublock/web_accessible_resources/amazon_ads.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
General
- Target extensions/ublock/img/ublock-defs.svg
- Size 1KB
- Sample261020-nfcjgsbc29
- SHA256 4ec29d3c40515cae50cb3fd5e38244e4f034d1406d0860066623cf4ab109ac5a
- MD5 54c0a6c3955bd046341b31e5352c3618
- SHA1 e57535ae602a9abd04a75d3acee2e8b5b3640c48
- SHA512 3db15fa77cb43bcdeb060d6f1d93c99db39aade9ba4f2d16633cd258f94e339a2346cbd8d841dc3a3d471f2f987fbd05060319424ce6be59b1a1341ce3793895
- TLSH T13F31870F4054C7BA89882BB17C9E12DAD522FA6721FD9865B9C5524C8F0DF3E2C57ACC
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5388 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 2636 chrome.exe 2636 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe Token: SeShutdownPrivilege 3288 chrome.exe Token: SeCreatePagefilePrivilege 3288 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe 3288 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3288 wrote to memory of 3900 3288 chrome.exe 80 PID 3288 wrote to memory of 5600 3288 chrome.exe 81 PID 3288 wrote to memory of 5600 3288 chrome.exe 81 PID 3288 wrote to memory of 5388 3288 chrome.exe 83 PID 3288 wrote to memory of 4820 3288 chrome.exe 84 PID 3288 wrote to memory of 4820 3288 chrome.exe 84 PID 3288 wrote to memory of 5060 3288 chrome.exe 86 PID 3288 wrote to memory of 5060 3288 chrome.exe 86 PID 3288 wrote to memory of 568 3288 chrome.exe 87 PID 3288 wrote to memory of 568 3288 chrome.exe 87 PID 3288 wrote to memory of 6044 3288 chrome.exe 88 PID 3288 wrote to memory of 6044 3288 chrome.exe 88 PID 3288 wrote to memory of 2964 3288 chrome.exe 89 PID 3288 wrote to memory of 4612 3288 chrome.exe 91 PID 3288 wrote to memory of 1500 3288 chrome.exe 92 PID 3288 wrote to memory of 4396 3288 chrome.exe 93 PID 3288 wrote to memory of 2636 3288 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\extensions\ublock\img\ublock-defs.svg1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0x84,0x108,0x7ffdf5e4c728,0x7ffdf5e4c734,0x7ffdf5e4c7402⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,16067362790650268541,7137859165702552469,262144 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,17943092254121377576,5573213318666852273,524288 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2284 /prefetch:112⤵
- System Time Discovery
PID:5388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,385377930982737531,81762524883842337,524288 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2400 /prefetch:132⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,3328737846628781803,17773892473475102824,2097152 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,4055707224452803798,18360751804709542383,2097152 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,6961152152900326131,17560568212818378160,2097152 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4376 /prefetch:92⤵PID:6044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,6139976521695326428,14836951523227968624,524288 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5304 /prefetch:142⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,15075751043106950907,11257676732812193795,524288 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:142⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,6955219871196973299,3416929266064744835,524288 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5528 /prefetch:142⤵PID:1500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,4119843096152224940,6376224558300893423,524288 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5736 /prefetch:142⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4356,i,1297051114498068164,17558882075874210301,262144 --field-trial-handle=1992,i,1958083262640435359,8905599780968745082,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1020 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2636
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4257c6b8-cce5-4e06-9b67-c405c3e77f1d.tmp
- Size 131KB
- SHA256 8b93aa159c02af7a1bea8cd78eb3cf2b6acf1e25c789a9a9bb4ffd859f95f507
- MD5 8e2894fc04d50567c3e13bce0aac858e
- SHA1 583aec665f100d770dfad2544e788b12c9c1b239
- SHA512 0b374c1edb71664955ba42567751ac65080a37dd1f4a318188cbfe37e1dbb06a81111f490258a10a211aa474bbb1cc270d0052f5483241538a08228e05f07308
- SSDEEP 3072:gsfH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:gsNt4fLJ0L6nGJxi3bzqapJjP
- TLSH T12ED302F0C1A06C7ACFF7EE4145756E948EB1D5C749CDBE2409E98C5812CAA784A13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9a52cf17-f372-4768-8c7e-abcfd85be971.tmp
- Size 131KB
- SHA256 0b7b0e34c352a603e579901aee87291421bbdda50f1251e0975666110548a61f
- MD5 2263c1e89856bf3c62f4a40a26636147
- SHA1 2b51cfc7598475b79bb7efd9b51512e71ceca36c
- SHA512 5ed79dfbd0369a278307f85072cd922fe5d545b73b270dd5e897092aaf83c59a907e8b7802f0cca8541a89d8adccce8a9a8f7802bfc62a8a21424795ac68fea6
- SSDEEP 3072:PM7H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:PMZt4fLJ0L6nGJxi3bzqapJjP
- TLSH T15AD312F0D1A06C7ACBF7EE4145756E948E71D5C289CDBE2409E98D1806CEA344E17EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\01031de0-3ed0-46ba-a10d-b6762685e669.tmp
- Size 414B
- SHA256 ca107245ebf1a840cb72650df4ee7cb12a3a010f4ffacd9069a9519e07a5dbee
- MD5 8e8fa62960d9ae9367a8e64e59067dc3
- SHA1 adfbfe77236bdad970475f0702c95dd936c73327
- SHA512 a17a63dee7109eb818c99e40bc17e1210a4c4f947fa49f88a44bc7a2aac8cc379e08b2d928c231ac5d9d26116d675be80e217478dfd100733793226cd7d1dda1
- TLSH T14EE02BA6C921EC3B18FD0B595055064DEA4013773A40490F3B3D911D8FB19375599C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\70f07884-16db-499d-af7b-fbd5ec5b6f67.tmp
- Size 17KB
- SHA256 6ca764e0b820ad72765be98a047d4bc42fb19d6b92045247da608a4d9a78a38a
- MD5 caaf777f40b07da3669780a2f4e68f73
- SHA1 7e6ec70386c184a70405672d597b86a32af86d41
- SHA512 732c5d108a83ba47d9be4f5769307cf922ba5bf089eac5dbfdc915d7f9efbaa61c02843a981f962c25bb78a11ed8addad486e8839e081ed436d061f7f71d2d73
- SSDEEP 384:wGjUD7KxkXqKf/pUZNCgVLH2HfgslMl7pLkdLceSOPXODU/+ErU36ZHwiQ3E9s:wmUD7KxkXqKf/pUZNCgVLH2Hfgsml7p1
- TLSH T16A72F967AC4C9E3B0F94CACDDC177A4FACB5024B61E9886443FA582903D5ACF110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\11cca2da-5364-46ac-8447-adfd0656569b.tmp
- Size 1KB
- SHA256 9bf520b9d47ac330e577d36bb20c5ae04716e8caddd18e363a23553c58befc90
- MD5 83be20f4fbac2b1bc44097dc316fa6a4
- SHA1 a8110cf1bb842825847750019889483688202a60
- SHA512 90e0cbf0783f1ed834da75331deee94993b349e7878d742101cda4c45b7978acf32a4b9201332b8a1e21baa60bb1188f50a14cff2e85f0967e8e81aae41d9dd2
- TLSH T1B1418AF793B4857E8A1192F4EA15AE1FCE6D0924031C3CA688D46E1B93F2872D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cd47df3d-1c97-4112-ae90-f7baad6b4c6c.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 f1c5fc57f264f06f96a3661f0f01398bbddd2a02a58fc4c3268f3f8d81592405
- MD5 207ae59564c762e57f0a65ff9efdd672
- SHA1 927d45d9d987e1a019585b26a82424818df34be5
- SHA512 0e33354b54946f609f5d3bab92d1cad3aa79629757c4260933037a470fe8960f695256b96e26820a7e6e1a3bf7ba1f2c5d2760ee8e3937c3831b91cae455ee42
- TLSH T139B0120580412301C44103B02150905832F0DF34D152138D41E00D078C35171411725C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 6288d5efda6c46c40718dd3a2d202aa51eb3a58546f0329c511fc84138b00cf3
- MD5 889afb15bdbf42178649db2ed18cbbb9
- SHA1 9bc0be8dcb78ba52bc4ac034532160e7561e4d7b
- SHA512 02b22bd15ed7449873421a0bcda12b025368625322186c49dbbc44128bb9cb98d513d7ddc28d5eb57925cb7defce6a598e7435b9416a5c7d812cc82056058063
- TLSH T1B6B02200C0C32283C00303F02A8288CCB220CF30C203AA0282E00A33CC202308228030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c29347c2-b09a-4783-8da1-08aba06c7c6f.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\feb83d7e-e3c7-4b56-9b48-9b8ff2c9c88b.tmp
- Size 12KB
- SHA256 034647440c81df8b8a140219ccfa34884fca7ba864f6b179ef60a99208c58cb2
- MD5 101bc30b2b43bf0632db4c47aa530e67
- SHA1 3b41a78a95e11b2c1e310036be05d341561390fb
- SHA512 26e7e7f7bb8d0d3826af2dd3142e9a2412b3531e456233ff52ae36c31d30e21da092cc14e96fb78a377e874fc23c244d45f6ed07f9bca46e1baac6f2fe1e9047
- SSDEEP 192:xRlwRr2cOCv7fpAPRp20e9UHsb+WNnc46P8cep9n7aKZhDVyIsnAUge:xRlw8OjUX8WwKPe97aole
- TLSH T1B842A52DED10753BACEBD21AFA667767E6F5102130A42E84E6FC893C25E75CC2127417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a9abae26-e0ff-4ad3-8f6b-453d85cc2f6b.tmp
- Size 130KB
- SHA256 033a2cd8b74bf052dfcdffe426335ead9dbc12717bbd8f3131131931570a0f40
- MD5 78b6f149b1897f4ea3290c6a39a2ba5b
- SHA1 be7dadc45700bb62b078a255cb5b2b1bdd2ef932
- SHA512 93b9fcf65c42e5c7a468f291141f716c7753c6df8b56ca6d9fb5a9e8c2d9bc779c692b9853492fb1f386ac1815195e97bb752d58a630af345bdd2a48d322969c
- SSDEEP 3072:6+H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:6ut4fLJ0L6nGJxi3bzqapJjP
- TLSH T12ED312F1D1A0AC7ACBB7EE4155B55E948E71D5C289CDBE2408ED8C1816CEA344E13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c4165eea-83f6-452c-b0b7-e6ad9c6557b5.tmp
- Size 131KB
- SHA256 aeab992749255ddb8aea84f1642be9a6e96825c84f22db7611241d293ad64ddc
- MD5 9437f905f1645dbbb2602d51238e1c98
- SHA1 1cf702fabeaa271cc4a126ea952892874ef09baa
- SHA512 108afc6890df17f29189be720d8935299bdeccfa630a979af6d4a6d046dddcf17cba13c4f47cec9ba192acd01c2e3910d839581cf3b43cbe1fe77933783ec88c
- SSDEEP 3072:OM7H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjP:OMZt4fLJ0L6nGJxi3bzqapJjP
- TLSH T164D312F0D1A06C7ACBF7EE4145796E948E71D5C289CDBE2409E98D1806CEA344A17EB3
- MD5 SHA1 SHA512 SSDEEP TLSH