Overview
overview
8Static
static
3Kryoto-Des...up.exe
windows11-21h2-x64
8extensions...gn.svg
windows11-21h2-x64
3extensions...on.svg
windows11-21h2-x64
3extensions...fs.svg
windows11-21h2-x64
3extensions...ck.svg
windows11-21h2-x64
3extensions...d.html
windows11-21h2-x64
3extensions...ers.js
windows11-21h2-x64
3extensions...ers.js
windows11-21h2-x64
3extensions...out.js
windows11-21h2-x64
3extensions...ngs.js
windows11-21h2-x64
3extensions...ser.js
windows11-21h2-x64
3extensions...wer.js
windows11-21h2-x64
3extensions...ets.js
windows11-21h2-x64
3extensions...und.js
windows11-21h2-x64
3extensions...tom.js
windows11-21h2-x64
3extensions...rks.js
windows11-21h2-x64
3extensions...rie.js
windows11-21h2-x64
3extensions...ast.js
windows11-21h2-x64
3extensions...age.js
windows11-21h2-x64
3extensions...oad.js
windows11-21h2-x64
3extensions...-ui.js
windows11-21h2-x64
3extensions...wer.js
windows11-21h2-x64
3extensions...ead.js
windows11-21h2-x64
3extensions...rch.js
windows11-21h2-x64
3extensions...ing.js
windows11-21h2-x64
3extensions...ing.js
windows11-21h2-x64
3extensions...nds.js
windows11-21h2-x64
3extensions...ole.js
windows11-21h2-x64
3extensions...tra.js
windows11-21h2-x64
3extensions...ipt.js
windows11-21h2-x64
3extensions...abd.js
windows11-21h2-x64
3extensions...ads.js
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260911-de - resource tags
arch:x64arch:x86image:win11-20260911-delocale:de-deos:windows11-21h2-x64systemwindows - submitted
20/10/2026, 11:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kryoto-Desktop_0.2.27_x64-setup.exe
Resource
win11-20260911-de
windows11-21h2-x64
32 signatures
150 seconds
Behavioral task
behavioral2
Sample
extensions/ublock/img/material-design.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
extensions/ublock/img/photon.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
extensions/ublock/img/ublock-defs.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
extensions/ublock/img/ublock.svg
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
extensions/ublock/is-webrtc-supported.html
Resource
win11-20260911-de
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral7
Sample
extensions/ublock/js/1p-filters.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
extensions/ublock/js/3p-filters.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
extensions/ublock/js/about.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
extensions/ublock/js/advanced-settings.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
extensions/ublock/js/arglist-parser.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
extensions/ublock/js/asset-viewer.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
extensions/ublock/js/assets.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
extensions/ublock/js/background.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
extensions/ublock/js/base64-custom.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
extensions/ublock/js/benchmarks.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
extensions/ublock/js/biditrie.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
extensions/ublock/js/broadcast.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
extensions/ublock/js/cachestorage.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
extensions/ublock/js/click2load.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
extensions/ublock/js/cloud-ui.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
extensions/ublock/js/code-viewer.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
extensions/ublock/js/codemirror/search-thread.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
extensions/ublock/js/codemirror/search.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
extensions/ublock/js/codemirror/ubo-dynamic-filtering.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
extensions/ublock/js/codemirror/ubo-static-filtering.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
extensions/ublock/js/commands.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
extensions/ublock/js/console.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
extensions/ublock/js/contentscript-extra.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
extensions/ublock/js/contentscript.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
extensions/ublock/web_accessible_resources/adthrive_abd.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
extensions/ublock/web_accessible_resources/amazon_ads.js
Resource
win11-20260911-de
windows11-21h2-x64
1 signatures
150 seconds
General
- Target extensions/ublock/img/ublock.svg
- Size 2KB
- Sample261020-nfcjgsbc29
- SHA256 05c39ebd5881bf4de1ad2d5f04c1dbfdeeb9e132be63ad6d6e341252f18a4afd
- MD5 0339b5f78cab4a9a9388c7d1e29c58ed
- SHA1 166660841a9b7bc72ca5b8a4293d810c4e0edbd4
- SHA512 b6306fe647fab8e030f8271473f8245d11a1dadf8f3da68d916f34aa948390bac870be4f37e3f154e9cdd0bed18f796ba317ed0b5cfcc7bb9bf149b482d38def
- TLSH T10251C018E7850677805D814897F2FA000637A9632B512A6BF5AE8B73AF0A5D131B72CF
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2868 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4484 chrome.exe 4484 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe Token: SeShutdownPrivilege 4104 chrome.exe Token: SeCreatePagefilePrivilege 4104 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe 4104 chrome.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4104 wrote to memory of 2936 4104 chrome.exe 81 PID 4104 wrote to memory of 5160 4104 chrome.exe 82 PID 4104 wrote to memory of 5160 4104 chrome.exe 82 PID 4104 wrote to memory of 2868 4104 chrome.exe 83 PID 4104 wrote to memory of 1240 4104 chrome.exe 85 PID 4104 wrote to memory of 1240 4104 chrome.exe 85 PID 4104 wrote to memory of 3672 4104 chrome.exe 87 PID 4104 wrote to memory of 3672 4104 chrome.exe 87 PID 4104 wrote to memory of 3960 4104 chrome.exe 88 PID 4104 wrote to memory of 3960 4104 chrome.exe 88 PID 4104 wrote to memory of 3160 4104 chrome.exe 89 PID 4104 wrote to memory of 3160 4104 chrome.exe 89 PID 4104 wrote to memory of 3964 4104 chrome.exe 90 PID 4104 wrote to memory of 5492 4104 chrome.exe 92 PID 4104 wrote to memory of 2304 4104 chrome.exe 93 PID 4104 wrote to memory of 1404 4104 chrome.exe 94 PID 4104 wrote to memory of 4484 4104 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\extensions\ublock\img\ublock.svg1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff849bcc728,0x7ff849bcc734,0x7ff849bcc7402⤵PID:2936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,15714945448583233466,14295429296762810139,262144 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1960 /prefetch:22⤵PID:5160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,4236622693164671578,14502787322774138604,524288 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2240 /prefetch:112⤵
- System Time Discovery
PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,5572637871225000266,14131896326982629869,524288 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2380 /prefetch:132⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,5038155411449836456,6728912596612688548,2097152 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,1031217923573120431,11964748446511526281,2097152 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3976,i,12792322317780448678,15544580885416191122,2097152 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4168 /prefetch:92⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,3556349803334523656,9068895538433794827,524288 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5300 /prefetch:142⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,14067310665230645373,2663148471508608067,524288 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5492 /prefetch:142⤵PID:5492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,7235342817711482793,15494342354966484665,524288 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5688 /prefetch:142⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,15225044588300928900,2581525293568299761,524288 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5420 /prefetch:142⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4576,i,8374165412389949762,8202914654094086964,262144 --field-trial-handle=1964,i,9408264657301316073,13502544777618352436,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5032 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:4484
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1788
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\02d08673-b3e5-47d2-a9db-c7a86f9042f8.tmp
- Size 131KB
- SHA256 b50970b98a29b9ee36e434bbd37e6a04a047e4db459c188ce4ce041138fdf5b5
- MD5 0cce04e075317c2b9409226f0dcb1954
- SHA1 e94002dfd77c48875bb9f0d5448ed3e72e95cce2
- SHA512 7d631b716041f79e7e16e47227d99c5dd7bb8209c7771c4c5b98cffda3d9beef886c81d3b101ec99391f509f1c87b6cc9ba8faf43e2477038497c6d22c4a7378
- SSDEEP 3072:w7H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:wZt4fLJ0L6nGJxi3bzqapJjk
- TLSH T14DD312F0D5A06C7ACBF7EE5145756E948FB1D5C6898DBE2009FA881806CEA344E13E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3ad7b05d-0faa-45cf-ad64-415abb66fbff.tmp
- Size 131KB
- SHA256 5d4dcef1b4b0be8ceee5b44d686e73aabb9610525e8bf60945614c3ae39f5524
- MD5 b2860bfba9099503d475edbbf85db627
- SHA1 314ef01ed81634e05079e2e3cf446b771d9948bf
- SHA512 4088b671bf8648f7f683569766a0910f38ebac2898cbfdf1028744444f2ea81937038b84d65d8e5250ec25d50628c445ab68eba548e9258867b2757dbc26d415
- SSDEEP 3072:57H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:5Zt4fLJ0L6nGJxi3bzqapJjk
- TLSH T166D312F0D5A06C7ACBF7EE4145756E948FB1D5C6898DBE2009FA881806CEA344E13E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\723927a4-3590-40e0-975d-3dc850658d62.tmp
- Size 130KB
- SHA256 35f9e98aff5bf36cfec1f4172547c8b664753854825e947cf88e338e4490538f
- MD5 95bcec439c7389f6a5a39fdebd5fd1b6
- SHA1 36c67fd7dc59220689f26b48b614fcd4547c6872
- SHA512 4bc14f90d81e4cf12b071bab2baf2120ff3e98fd62520a84d8c5cde40d64e985ad1931d72f9b259fe8cfa94061c82d17a5f9181d6be131bdd8beef1e03d51432
- SSDEEP 3072:aH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:at4fLJ0L6nGJxi3bzqapJjk
- TLSH T16AD312F0D5A06C7ACBF7EE4145756E948F71D5C289CDBE2409F9881816CEA344E13EA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\20fa2f7f-e3e9-4f1f-8f37-989f1fec1718.tmp
- Size 12KB
- SHA256 1c11a81e7d9709c3671f5818c9dd7d1a4f5b986e69494ec6fdceebd894065f83
- MD5 da8cbc1d192086162b8da180c06da953
- SHA1 176d0011a051d80291f7cae75dd3d92155a7fda2
- SHA512 846a2396ebeac9513e122a3d8d6e468586e2d17f84ff9675454c480678d7db788fc244bccdc28290518f53746b53fc9c532c3103eea56a54b7abd901f8a8465a
- SSDEEP 192:iReGRAE0VSXv7bpAPRp2XHn9/Hsb+WNnN1PTkaMKuv7cEPVyIsnAUge:iReGO6/PUX+HtwbPQaMKQgEe
- TLSH T18B42C62DE9147A7BACDBD229FA667717D7F5102120942E88EAFCC92C14D7ACC2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\367112fa-63e4-4a2c-9495-cd4fe60edc94.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4d3d3809-e482-4ca7-83aa-6d978ad3417c.tmp
- Size 17KB
- SHA256 eba14d9b7e188ff66c3f32ab105ba7f0bb51df574e5a9fd412e1a1b3cfa53d7d
- MD5 79d17334d91e7749a3b5a5a98775b938
- SHA1 a617c2db866b9e9cda0464916794d1a6020cb8e6
- SHA512 a35cc8449ebfd932156fc2847d336fd310aeed3bf1d78f818c244e8f1d63d1a8135abf29eb81036ee998442824f6c1da3b5625dcb11d64f4949c18141387b028
- SSDEEP 384:Q2j8z7KxkXqKf/pUZNCgVLH2HfgslO07pLkdLceSe/XOD8P+ErU3flHwFwS6e:Q28z7KxkXqKf/pUZNCgVLH2HfgsI07pC
- TLSH T1B77209676C4C99770FD8CACCD827BB4FADB5024B65E9886443FA5C2903D5ACE110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\98061278-2ea2-4a44-b410-e86c205be61d.tmp
- Size 414B
- SHA256 26d9bfe293e4fe3b069602cf9f5f3b2bd52edbe8b95e4751d4a2e2433ea72319
- MD5 2da9a948dfce01d5c921e370434ae625
- SHA1 4ffdfd96cd930a2b05130bb78185c7ab62d4e6ea
- SHA512 430c633fc88082ef2a7b8263fab20abac25a91f461c1f345b8a9eb9eb8dd256882c28adaf187fb3b3b82871a77612c5ef7c40ecdb7f13975b0a475610006d77e
- TLSH T187E022A9C821FC3B08FE171C50A44B4AE64063573792895F3A3EC11C8FB563B07DA8AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2fdbb9a0-a47e-46b5-aafd-de2498201c45.tmp
- Size 1KB
- SHA256 7593fa7b31f2ddfcb2d78f111979ad4ab920ce5f241182a06a2c8de645e776ad
- MD5 a912f842a447f1595428e76d2c48e304
- SHA1 372f5e35aacb849fa9b71bc3ec9083ab3602cdae
- SHA512 3677f590490021e85564a8af9b3ee7bb2e87d736714875388065e227a6f92e38a705ff88f1e455a56d159b72ca0a62d8e0659fa1e832dca56f545998ca47b551
- TLSH T1F8419DF797B4957E861196F4EA156E1FCE690524131C3CA688D46E1B83F2872D10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b7ff7950-b19e-4406-baf2-9f5e8471d168.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 120B
- SHA256 af4cf43e6d8f5248cbde4728135b9ee9164df840ef51539723575f22fbf11767
- MD5 a782890b79ab6ae5b2b0ea238eb1b4f6
- SHA1 fb15f4521637d824906d6474d8a23e9450696d0c
- SHA512 51769c49851de0f52fe619ca75ea602ed633708e9b53c9614c40087dc9661e50d81d2f2778b263863a7aa7bbfe0fbfecf92dcf65326d292fd9c61bfd5a64159c
- TLSH T18BB0120681853301C40103B41550905832608F38D132138951F00D418C39150501714C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 acdc5d6b1077755ceb519aaa69390013adeb3893e45a208854c802de849fd564
- MD5 9da26a4c43df24ace164eceee18e6162
- SHA1 05c84308158da3e92eb5ce0c996a19203cf2b13f
- SHA512 2732e10df7333f507784e5e75755a09ca151c0874a9d5e1c426d195f1d5313ab7b2290c5fc73231415c38d74afe2e464189e9ae176ce582514a233d90dd76ea8
- TLSH T1A8B022B0C2023203C08303B02888C0C830A0CF30C203020EB2E02A22CC202300028020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b35d56d7-b4b0-432e-9b8d-6902ceb19c7e.tmp
- Size 131KB
- SHA256 d051d805a4d7673bd340e136a0d901999327b20609ef5de77aeab70920316a47
- MD5 a447cc0e08da3a3d5d6ea997e661416b
- SHA1 88d20c2850c2e42dcc76611553fc73d2edec16c3
- SHA512 4ab6648a29ab990adc619a03d238b39476c2fabc663c2d11b4a3b5ea0b4a2246c0525f2d1cd7bb0ee0127029d7b9607565d268b026e4dda910dce502484e2983
- SSDEEP 3072:tGxH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:YXt4fLJ0L6nGJxi3bzqapJjk
- TLSH T114D312F0D1A06C7ACFF7FE4145756E948E71D5C6498DBE2409FA8C0816CAA784A13EB3
- MD5 SHA1 SHA512 SSDEEP TLSH