Overview
overview
6Static
static
1URLScan
urlscan
1http://bit.ly/KWYlT
windows10-ltsc_2021-x64
3http://bit.ly/KWYlT
windows10-2004-x64
3http://bit.ly/KWYlT
windows11-21h2-x64
3http://bit.ly/KWYlT
windows11-ltsc_2024-x64
3http://bit.ly/KWYlT
android-13-x64
1http://bit.ly/KWYlT
android-10-x64
1http://bit.ly/KWYlT
android-11-x64
1http://bit.ly/KWYlT
android-14-x64
1http://bit.ly/KWYlT
android-15-x64
1http://bit.ly/KWYlT
android-9-x86
1http://bit.ly/KWYlT
macos-10.15-amd64
6http://bit.ly/KWYlT
debian-12-armhf
http://bit.ly/KWYlT
debian-12-mipsel
http://bit.ly/KWYlT
debian-9-armhf
http://bit.ly/KWYlT
debian-9-mips
http://bit.ly/KWYlT
debian-9-mipsel
http://bit.ly/KWYlT
ubuntu-18.04-amd64
6http://bit.ly/KWYlT
ubuntu-20.04-amd64
6http://bit.ly/KWYlT
ubuntu-22.04-amd64
6http://bit.ly/KWYlT
ubuntu-24.04-amd64
6Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - max time kernel
600s - max time network
599s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
23/10/2026, 11:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://bit.ly/KWYlT
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
11 signatures
600 seconds
Behavioral task
behavioral2
Sample
http://bit.ly/KWYlT
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
600 seconds
Behavioral task
behavioral3
Sample
http://bit.ly/KWYlT
Resource
win11-20260911-en
windows11-21h2-x64
10 signatures
600 seconds
Behavioral task
behavioral4
Sample
http://bit.ly/KWYlT
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
600 seconds
Behavioral task
behavioral5
Sample
http://bit.ly/KWYlT
Resource
android-33-x64-arm64-20260708-en
android-13-x64
2 signatures
600 seconds
Behavioral task
behavioral6
Sample
http://bit.ly/KWYlT
Resource
android-x64-20260325-en
android-10-x64
2 signatures
600 seconds
Behavioral task
behavioral7
Sample
http://bit.ly/KWYlT
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
600 seconds
Behavioral task
behavioral8
Sample
http://bit.ly/KWYlT
Resource
android-34-x64-arm64-20260325.1-en
android-14-x64
2 signatures
600 seconds
Behavioral task
behavioral9
Sample
http://bit.ly/KWYlT
Resource
android-35-x64-arm64-20260325-en
android-15-x64
2 signatures
600 seconds
Behavioral task
behavioral10
Sample
http://bit.ly/KWYlT
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
http://bit.ly/KWYlT
Resource
macos-20260915-en
macos-10.15-amd64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
http://bit.ly/KWYlT
Resource
debian12-armhf-20260127-en
debian-12-armhf
0 signatures
600 seconds
Behavioral task
behavioral13
Sample
http://bit.ly/KWYlT
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
http://bit.ly/KWYlT
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
http://bit.ly/KWYlT
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
http://bit.ly/KWYlT
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
http://bit.ly/KWYlT
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
8 signatures
600 seconds
Behavioral task
behavioral18
Sample
http://bit.ly/KWYlT
Resource
ubuntu2004-amd64-20261019-en
ubuntu-20.04-amd64
8 signatures
600 seconds
Behavioral task
behavioral19
Sample
http://bit.ly/KWYlT
Resource
ubuntu2204-amd64-20261019-en
ubuntu-22.04-amd64
8 signatures
600 seconds
General
- Target http://bit.ly/KWYlT
- Sample261023-ncbssadv4k
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 916 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 3560 chrome.exe 3560 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe Token: SeShutdownPrivilege 4296 chrome.exe Token: SeCreatePagefilePrivilege 4296 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4296 wrote to memory of 1396 4296 chrome.exe 83 PID 4296 wrote to memory of 4564 4296 chrome.exe 84 PID 4296 wrote to memory of 4564 4296 chrome.exe 84 PID 4296 wrote to memory of 916 4296 chrome.exe 85 PID 4296 wrote to memory of 2336 4296 chrome.exe 86 PID 4296 wrote to memory of 2336 4296 chrome.exe 86 PID 4296 wrote to memory of 4788 4296 chrome.exe 88 PID 4296 wrote to memory of 3872 4296 chrome.exe 89 PID 4296 wrote to memory of 4788 4296 chrome.exe 88 PID 4296 wrote to memory of 3872 4296 chrome.exe 89 PID 4296 wrote to memory of 5104 4296 chrome.exe 90 PID 4296 wrote to memory of 5104 4296 chrome.exe 90 PID 4296 wrote to memory of 2092 4296 chrome.exe 93 PID 4296 wrote to memory of 1736 4296 chrome.exe 101 PID 4296 wrote to memory of 3384 4296 chrome.exe 102 PID 4296 wrote to memory of 4820 4296 chrome.exe 103 PID 4296 wrote to memory of 3560 4296 chrome.exe 104 PID 4296 wrote to memory of 1032 4296 chrome.exe 105 PID 4296 wrote to memory of 1032 4296 chrome.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bit.ly/KWYlT1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffe59aac728,0x7ffe59aac734,0x7ffe59aac7402⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,12099830954494217833,6691036682750106285,262144 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1836 /prefetch:22⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,17703257020027821749,17695975740560570772,524288 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2260 /prefetch:32⤵
- System Time Discovery
PID:916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,15056323503302662901,1216749109572925116,524288 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2388 /prefetch:82⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,6018087595044939442,7722184716623263241,2097152 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,16549809065378286094,7885497867575479301,2097152 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,1874847188988032848,13079187808924958990,2097152 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4560 /prefetch:12⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,1866356518430096714,8586054588736229867,524288 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5068 /prefetch:82⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,5400045311240924737,911696598223183236,524288 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,14155638808541375334,5579133919693092392,524288 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,13522455846726978317,5509847232750501837,524288 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5412 /prefetch:82⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=848,i,15072755984242388252,13111440369516139667,262144 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5268 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1276,i,13470145479229141899,10064420487350126736,524288 --field-trial-handle=1952,i,12904564271135559952,4742723589024817128,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5268 /prefetch:82⤵PID:1032
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:2300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4c5ce146-33eb-45bb-8c96-593baf24e5e9.tmp
- Size 132KB
- SHA256 a66d08bef820bc6eb8910d583982be8e73741741969068d97185a69cb6d17ac1
- MD5 85ebf1e3372eaeb4e51f8d2e210739cd
- SHA1 3e31767eaf0f8c4e6d118714833bc58b71fc71e8
- SHA512 10890ab89baf4e62e20ea5ed158e83c22e68337f341c4c160547ff07850fae807b129ed42781a6c84cea5b49724ea712710838c2afff002488027142473622e0
- SSDEEP 3072:RIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:9Ptbmf1K49XLWbEPi4NTKlLzB
- TLSH T100D312217D45BCB4A9EEEB21A1501A15DAB8D90B953D3BE65CDE3F8805E36DDC304C23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\76f5d5b3-bcb6-4f18-88c3-a3a4ab7fc51e.tmp
- Size 167KB
- SHA256 26aac937d62f735f9b187186b23f7d21ce83c4cfed736cbc9df396a118674287
- MD5 10ca311211ae253b207aecc23e0ffb97
- SHA1 e7d5be42a59b366d0fe726e01424076980b82e72
- SHA512 4c4fd07a4335e43e89da1c81e8b5e814b01bf96e2c38334fbdf2411a1c986fe44ba1c800c4a74560d4cc1e609e3ac82ae198dc56c20e1aa451a0d8a896bf76dc
- SSDEEP 3072:PPy9a2HPQkFjJn3i1IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZR:PPdyIkFl3ePtbmf1K49XLWbEPi4NTKlR
- TLSH T1EDF312317E66B8B4ECADE621A1806E54ABFCC84FA57977F258DF3F9404A66DCC104813
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8eea38a6-205c-42cb-87a0-9e26c45260d4.tmp
- Size 131KB
- SHA256 dc612b9e6e489d46082b0f29ac9458acdb832673a1e9711e09df281db558adee
- MD5 0060d98b1dfa6f0176e54bfb678dd23f
- SHA1 228a34e1f67c35893124e46e931ac9941fe46b95
- SHA512 c7e375eb6862e65649fa0f2ce77d67e78b2ea21d573e9ec1660fbd0ac1fe161e77681c0fea31deb949364276a4033ce5c993ea743b01f4ea9207cd9583a5cfff
- SSDEEP 3072:aIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:6Ptbmf1K49XLWbEPi4NTKlLzB
- TLSH T16CD312213E41BCB4A9EEDB21B1902A15EAB8D94B953D3BE61CDE3F4805E36D9C304C13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1f40a5c3-5cff-4a8d-a2b8-22fc680ed036.tmp
- Size 11KB
- SHA256 aff0e4e2e800a0624dc7447fa4b5a906bb355f4aea2140954fc7994ebd8eba27
- MD5 96576de5c35e4e1fc305595d960f18e6
- SHA1 a8857499122c3a415c9c81def89cdd41dd398f89
- SHA512 014277ee5965faf394fa13d1dc997a29ad92754001aeb1414fcc5c6873dc35c9662a8fc534c0940fecb14592d0a25815cbcfa33ff49b562f04e087b758ddddf9
- SSDEEP 192:wRp/9G+v7aqpAPRp2By9LHsb+WNn+/S6Q2xfkSQe22CraqmsVyIsnAUge:wRp/Y6rUXp5w8I2eSA2matIe
- TLSH T19B42B62DAD64797B5CEAC31AF9267753D3F9102134A12E80EBFC892C25E75CC222741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\77077727-bca8-4870-b45d-6f6c2827f2ea.tmp
- Size 414B
- SHA256 2731f5bb1789a0ec6d4988fef477ac48aa0e3d64a6081e00b63b2d56a3cdcff4
- MD5 2599e5a19e5cc7c5b6bf3fed6a5e598d
- SHA1 1e13f42e6710f2d6631fe1bd7d1f89181d7fd57a
- SHA512 d3698e74143d3bfcac75aa5ccaa4cd8bfb32601c2ab8f9edaad6b291fb2a8f33529400d8c28e5d5f9bc3b81134dfae5d8b5ea8a32c2bd60daabdb2c94298df90
- TLSH T1F2E0ABA9CC31FD330EFC430C10520746E30013472B60588F3A3E81098FB923A054A85C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\50427a4a-fcdf-436d-8bda-52914036b0b4.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bf16b674-7936-40d7-9f08-08b4147cbdba.tmp
- Size 1KB
- SHA256 f91cdd9ac8a947dc64e3ea89adda3d1c0593e7784a617d80d92b032704c151e6
- MD5 354c00b8ec738ba29f6df966e9afec04
- SHA1 708711d97c7d5a7d881f2b32bb45805f11cf1335
- SHA512 65cafecd99e33edb0ea189ffe21ca1f743dd191b3ad9e0e17cc0695e0c2e44a7063e538f2f483d588ac1fe0c0af9a6437cdabc58a97608fd69be7d7b7f4ad8cb
- TLSH T19831ABF793B0997E8A1192F4EA11AF1FCE690525031C3C7289D4AE1B83F2972E10078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d37468b1-7467-4714-8fc6-d76675eeb592.tmp
- Size 1KB
- SHA256 b2a76a5bc3ad0cd14ac54507fda0cba19f21a82d6726bdfd9e9d170dd1151021
- MD5 024ec4fb9fde6ea4c5f3979831384b29
- SHA1 ea4ff11d8222d6d957312ca94c98327393b83656
- SHA512 24771b4702e0ae888b579ad1df72f54fa028e674c87077a5b4ba5a631e52f6544adc682ebb5fd4e6c7069e35169bfd9704500b14dd96ae94a2d25d60928b54fe
- TLSH T19941ABF787F4997E8A1196F4EA106E1FCE6D0925031C3C6689E4AE1B83E2872E14074E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bf6d644c-b542-456e-a361-b1eb0b0736b4.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e5583d6c-931a-4cac-bb29-f30f3f3c206c.tmp
- Size 12KB
- SHA256 142246913ad4548dc7231fbd28ec5e57bba080c090aa1ca74878014a700272c3
- MD5 2a2af191cb85753e48a17f2fa05b7431
- SHA1 2bfc3b446d32685f15313f25ff5b8ec5c682faaf
- SHA512 692de9720d8a97d36f93b13a8bc49942f99d39dbd980e6d7e0e50a47f3eabe3c172979239f7528e437160ed448333e48021dbeda6e19812b206ca59cf9e6fe35
- SSDEEP 192:wRp/9G+v7aqp/rPRpaeBy9LHsb+WNn+/S6Q2xYkSQe22CraqfsVyIsnAUgE:wRp/Y6rhX05w8I23SA2mauIE
- TLSH T14842B66DAD64797B9CEAD31AF9267B53D3F5102134A02E80EBFC892C25E75CC2227417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f0f4e2ea-229a-4654-b670-cd38d4033207.tmp
- Size 11KB
- SHA256 80771ca56ddce23f92552d1b35a1aab8d08862e401f4a8cd24a64b041217650e
- MD5 9b6f30d2eaf991218e9f27cb7cc79878
- SHA1 94e30f36462caad95cc96914f2d756b1ad57e262
- SHA512 033b479135118696b89c4d274eb4a2b1d8eaf18d96f53f883de45c41ecae15cef77c38b0b20a14013e6510fec778289430e4c5881daf3cdba825e7ed24cc5670
- SSDEEP 192:esH4K6Cc7KxkXqK4I40pUZNCgVLHrKHfFKslE/E+XzKD/BE+ErUkKN9v5Y43HK6H:lHjJc7KxkXqKf/pUZNCgVLH2Hfgsl1+8
- TLSH T1E932EA27A88D6E3F0FE8D50DC8166F8FADF5025672640D2852FF9D0803A97CA115A5FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d052cb2a-1845-4605-ab90-8afe56e1cd62.tmp
- Size 132KB
- SHA256 307d2dd13213df0842ece13e308d19e58e01f75edee065ed68b70e031cdaf4d3
- MD5 35258d030e1b12c31e70c77df3df8a11
- SHA1 754db39653d8a0744ba9c896b83ba472b0fa26a1
- SHA512 d2d9c0a24b6f99cc0a12cdd2e38ad9f11bfb4f007a456ff7496f1ad8b37e0ae8958b71dce505e437250f6f6c388b317d149b7af99b5ad5b1d0f5a10299fc9a67
- SSDEEP 3072:OUIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:OwPtbmf1K49XLWbEPi4NTKlLzB
- TLSH T102D312213D55BCB4A9EEEB21A1501A16EAF8D94B953D3BE61CDF3F8805E3699C304C13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f5298489-88b8-4e41-873b-a66efb03c77d.tmp
- Size 132KB
- SHA256 0760e299785a3c67576af811291b9abfb71aa9e0acb328ce58602296da53c349
- MD5 b93bd4025901564e5213e455c946ca46
- SHA1 c3920eee671163f5c859bee14748613cdc604e99
- SHA512 f1486ccffe06a423e254c2baa9989fb1911faa3d9419db5be74e5c014c0c0ce93b919517e6913aa0e10380fff87d3e2c462e15efc7f30f03d9ca46a71da406f5
- SSDEEP 3072:1UIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:1wPtbmf1K49XLWbEPi4NTKlLzB
- TLSH T11BD312213D51BCB4A9EEDB21A1501A16EAB8D94B953D3BE61CDF3F8805E3699C304C13
- MD5 SHA1 SHA512 SSDEEP TLSH