Overview
overview
6Static
static
1URLScan
urlscan
1http://bit.ly/KWYlT
windows10-ltsc_2021-x64
3http://bit.ly/KWYlT
windows10-2004-x64
3http://bit.ly/KWYlT
windows11-21h2-x64
3http://bit.ly/KWYlT
windows11-ltsc_2024-x64
3http://bit.ly/KWYlT
android-13-x64
1http://bit.ly/KWYlT
android-10-x64
1http://bit.ly/KWYlT
android-11-x64
1http://bit.ly/KWYlT
android-14-x64
1http://bit.ly/KWYlT
android-15-x64
1http://bit.ly/KWYlT
android-9-x86
1http://bit.ly/KWYlT
macos-10.15-amd64
6http://bit.ly/KWYlT
debian-12-armhf
http://bit.ly/KWYlT
debian-12-mipsel
http://bit.ly/KWYlT
debian-9-armhf
http://bit.ly/KWYlT
debian-9-mips
http://bit.ly/KWYlT
debian-9-mipsel
http://bit.ly/KWYlT
ubuntu-18.04-amd64
6http://bit.ly/KWYlT
ubuntu-20.04-amd64
6http://bit.ly/KWYlT
ubuntu-22.04-amd64
6http://bit.ly/KWYlT
ubuntu-24.04-amd64
6Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - max time kernel
600s - max time network
590s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/10/2026, 11:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://bit.ly/KWYlT
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
11 signatures
600 seconds
Behavioral task
behavioral2
Sample
http://bit.ly/KWYlT
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
600 seconds
Behavioral task
behavioral3
Sample
http://bit.ly/KWYlT
Resource
win11-20260911-en
windows11-21h2-x64
10 signatures
600 seconds
Behavioral task
behavioral4
Sample
http://bit.ly/KWYlT
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
600 seconds
Behavioral task
behavioral5
Sample
http://bit.ly/KWYlT
Resource
android-33-x64-arm64-20260708-en
android-13-x64
2 signatures
600 seconds
Behavioral task
behavioral6
Sample
http://bit.ly/KWYlT
Resource
android-x64-20260325-en
android-10-x64
2 signatures
600 seconds
Behavioral task
behavioral7
Sample
http://bit.ly/KWYlT
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
600 seconds
Behavioral task
behavioral8
Sample
http://bit.ly/KWYlT
Resource
android-34-x64-arm64-20260325.1-en
android-14-x64
2 signatures
600 seconds
Behavioral task
behavioral9
Sample
http://bit.ly/KWYlT
Resource
android-35-x64-arm64-20260325-en
android-15-x64
2 signatures
600 seconds
Behavioral task
behavioral10
Sample
http://bit.ly/KWYlT
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
600 seconds
Behavioral task
behavioral11
Sample
http://bit.ly/KWYlT
Resource
macos-20260915-en
macos-10.15-amd64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
http://bit.ly/KWYlT
Resource
debian12-armhf-20260127-en
debian-12-armhf
0 signatures
600 seconds
Behavioral task
behavioral13
Sample
http://bit.ly/KWYlT
Resource
debian12-mipsel-20260513-en
debian-12-mipsel
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
http://bit.ly/KWYlT
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
http://bit.ly/KWYlT
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
http://bit.ly/KWYlT
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
http://bit.ly/KWYlT
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
8 signatures
600 seconds
Behavioral task
behavioral18
Sample
http://bit.ly/KWYlT
Resource
ubuntu2004-amd64-20261019-en
ubuntu-20.04-amd64
8 signatures
600 seconds
Behavioral task
behavioral19
Sample
http://bit.ly/KWYlT
Resource
ubuntu2204-amd64-20261019-en
ubuntu-22.04-amd64
8 signatures
600 seconds
General
- Target http://bit.ly/KWYlT
- Sample261023-ncbssadv4k
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4364 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 2168 chrome.exe 2168 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe Token: SeShutdownPrivilege 3504 chrome.exe Token: SeCreatePagefilePrivilege 3504 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe 3504 chrome.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3504 wrote to memory of 2832 3504 chrome.exe 85 PID 3504 wrote to memory of 1748 3504 chrome.exe 86 PID 3504 wrote to memory of 1748 3504 chrome.exe 86 PID 3504 wrote to memory of 4364 3504 chrome.exe 87 PID 3504 wrote to memory of 1680 3504 chrome.exe 88 PID 3504 wrote to memory of 1680 3504 chrome.exe 88 PID 3504 wrote to memory of 4328 3504 chrome.exe 90 PID 3504 wrote to memory of 4328 3504 chrome.exe 90 PID 3504 wrote to memory of 4696 3504 chrome.exe 91 PID 3504 wrote to memory of 4696 3504 chrome.exe 91 PID 3504 wrote to memory of 4652 3504 chrome.exe 92 PID 3504 wrote to memory of 4652 3504 chrome.exe 92 PID 3504 wrote to memory of 4796 3504 chrome.exe 93 PID 3504 wrote to memory of 796 3504 chrome.exe 106 PID 3504 wrote to memory of 3276 3504 chrome.exe 107 PID 3504 wrote to memory of 2528 3504 chrome.exe 108 PID 3504 wrote to memory of 2168 3504 chrome.exe 110 PID 3504 wrote to memory of 2420 3504 chrome.exe 111 PID 3504 wrote to memory of 2420 3504 chrome.exe 111
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bit.ly/KWYlT1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8406ac728,0x7ff8406ac734,0x7ff8406ac7402⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,8947436868644637055,5318080675319769787,262144 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1736 /prefetch:22⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,16430989236343962140,213026567025877687,524288 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2268 /prefetch:32⤵
- System Time Discovery
PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,5853111301619170602,9356168518638466438,524288 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:82⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,10381814561508832893,8331987937633123989,2097152 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,15195106553716749943,11700880573024274507,2097152 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4524,i,2900621530699184667,11617946156545912695,2097152 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4544 /prefetch:12⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5148,i,11814805489020395025,16506187082929886858,524288 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,3490963365592520639,4971870098790962639,524288 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5544 /prefetch:82⤵PID:796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,8876971309028738185,11831068119764063178,524288 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5548 /prefetch:82⤵PID:3276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,16457858389904924062,10728346298798036132,524288 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5580,i,694105238550464020,7130943516637426676,262144 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5324 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,5377313902107826544,7963389123593722565,524288 --field-trial-handle=1740,i,10890251425453781545,1664941068206344785,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3224 /prefetch:82⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0e1722ee-9f59-43fc-808b-0169006df59f.tmp
- Size 130KB
- SHA256 a82f74e7bd163bc8aa359bad62fe552320d452d07f2bacba045deea23a9a8cab
- MD5 8a03b6613988b24736eff142409ce40e
- SHA1 7395ed568109751160f08f8c4ac4012ad27d0aa5
- SHA512 dce3d86a4eb49cde5f5020b8b5b4dc311af6d8dbf1e19d31821b1859d44146996181a397bad586a3d4d958cdfed7130bfd122a013e4cfc8f890de927d793560c
- SSDEEP 3072:N+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:N+hFD+7t56OD9ZfSApprZ
- TLSH T185D31232AA91C8BBC9FC6541B197A300DE626CED45DE3A09444A5F8EE09FC4C0773A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\10edd1ca-bf45-4378-9906-36b3cbb88272.tmp
- Size 131KB
- SHA256 f9403f1185d9fd3cd48a17ce7ed37ea5d8a12820b20c1468644a5b63d7863b23
- MD5 b97ed4edf82b8407828a5e3be5285aef
- SHA1 024efa908c2f46fa5d3a4335321d3bbf2f6e7f95
- SHA512 29f6f52cfafddd2b32293d7d829f1060a7d574a3c9554fde45287e79a8e875774998bd72c3f3a6470ac7b8f4aab3383d2a2f0a1a5ca18395e33e7a5743da2a3e
- SSDEEP 3072:sCg+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:sCg+hFD+7t56OD9ZfSApprZ
- TLSH T17CD31232BA95D8BBC9FD6541B147A300CEA668ED45EE3A0944465F8ED09FC4C07A3A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\68bcb0d0-5ae8-41da-80dd-5225e8cefa80.tmp
- Size 131KB
- SHA256 bff1e57b00e69c11a40b81914c980b4154c4982c3cba6b66e39be41056ef1775
- MD5 f931c3bec60a61dff33dea52f4ed2b1f
- SHA1 3c74b2ba30cdbadebeedd209f196c10b6c6d149c
- SHA512 67a634f5208a342b6bca8fea1add02666fb315d62ce0af764e0bfeb2dc5ed157f8506d296ff91df4aca04757795d88c5768b63581937e2c3d787337dfa63455f
- SSDEEP 3072:ZCg+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:ZCg+hFD+7t56OD9ZfSApprZ
- TLSH T119D31232BA95D8BBC9FD6541B147A300CEA668ED45EE3A0944465F8ED09FC4C07B3A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\69b1082a-2110-4ef8-acef-0db0b752ca72.tmp
- Size 166KB
- SHA256 3f4fabdd7d70b770c9b77cda905169b65b26612e5207fcb68b1af10b3b148c45
- MD5 6c95cac3567ec8cbee6e556ad6884ef6
- SHA1 b16f6deb400fd015427e782205d111aae546baee
- SHA512 82d4a3f592a1eb92737a20f60b1c1285855a513163ed79f69080040772d66179116f956969f1764678393332f6ccfc463aa8e463a62ff27ef711e1d0d3329b99
- SSDEEP 3072:HPW2bwANHGsgJd+F+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:HP3bwAhGsA+F+hFD+7t56OD9ZfSApprZ
- TLSH T122F31236E695C87B89F8A500E107F314CE95A4EE61EA79094C4A5E4BD1AF95C03F3B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9cdba88f-c67d-4bbc-a6c9-1b1fe6ec95bd.tmp
- Size 131KB
- SHA256 9eb60f8c16042b362f2d2b41dcf7583eaecc37e2b90eba24d75c9c66d343deb8
- MD5 5df1c61160e23c5504eff403c47a4e56
- SHA1 69db313d1830c59ecbcac569db6687caf0833777
- SHA512 2bdfbe4804309a54692dbe4b2216b562bb4f7b896ba3afae3656f1f9796cb8a09224b483501f787b8ebe272001dc0643afd8981cfc14df59739ddac8cef21826
- SSDEEP 3072:W+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:W+hFD+7t56OD9ZfSApprZ
- TLSH T119D31232AA95D8BBC9FD7541F147A300DD6668ED45ED3A09844A5F8E909FC4C07B3A33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56cf31ba-30cb-429f-acf6-12d99a72c6f7.tmp
- Size 11KB
- SHA256 c2c9fb03e0b3fc76153f7bf95f0bc4a66f0a3c2f28fe2c51a69fcab03ba15f95
- MD5 185acb91fbbac83e52456321eed59afb
- SHA1 e42ac1e0ad2fb28fd6a5e8348e86f7cbb7d620c9
- SHA512 3c647cc41802e9c7bb970a9d7e6cd902c1d39d105a7463c2ac010a8c1d943ae7275d5bfb57bd630c80ee1dee2b7f9322d6a28085a4646b9d36e59bb0ed40b392
- SSDEEP 192:XR9abTMtv73pAPRp2849vHsb+WNn9i4Smd2Ik9XH/kqsVyIsnAUge:XR9afMNbUXEhwU492x9XHue
- TLSH T1DD429329AE50757B5DDBD22AFA227B53D7F5102264A42EC0EAFDC83C25E79CC2123407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\82d6d5ca-86f9-40b6-ac5b-4b7d9f5d97fa.tmp
- Size 12KB
- SHA256 dcffbfd1e0fdfbfefbb39d07a97a453764f7050963a5ef38a520a5aa15a5e9aa
- MD5 031e2f6864b1944c42c7379702006fbc
- SHA1 de56f2ea9469b9ca6105df678fec33dda131afea
- SHA512 06074d43142a020127ba6002d0ac8c95cafe4f7b2fb7fe0157d003ad399e3f20a4a3e3e39996c4046cb227016a04e867cc12de2e999d2c9afc494a873593cea6
- SSDEEP 192:XR9aRTMtv73pFPRp9849vHsb+WNn9i4Smd2Mk9XH/kq9VyIsnAUgE:XR9apMNbbXjhwU492l9XHdE
- TLSH T114429429BD50797B5DDBD22AF9227B53D3F5202224A42EC4EAFDC92C25E79CC2127407
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\93e906f1-7be0-42f7-834c-3f130a6d9129.tmp
- Size 13KB
- SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
- MD5 8607790a422ecb522e4c0dbd3b269b34
- SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
- SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
- SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
- TLSH T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\61709bc9-bb08-4c7e-8298-f435cc43928e.tmp
- Size 1KB
- SHA256 db133d68f8efe68f1c08e5e9d5609a2e0aa9fd8e55493579b5be117ad190b8f1
- MD5 0f5ad1a39b8bfdad4be38013d90a3b24
- SHA1 c7ced10cfd0ac599218a30a8d1d95aa7c0621b04
- SHA512 ee4e37d2f06b440e1ce36b4f44a07e84795878bb4ec0bd13c49d7e705b22501ffaba86c793144e212c0f4e304dd8144129756161799b4bc25f094c77bf080a44
- TLSH T1DB41BEF787F4857E8A1196F4EA106E1FCE6D0625031C3C6289E4AE1B43E28B2E24074F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9b011858-e879-4376-9ddf-2355c4f759a0.tmp
- Size 2KB
- SHA256 9a6e681ca4bf83abf310a24c95944429681f5adb500b57ca4d19a2b5c4d0f7cc
- MD5 6daa3defec00d6663e8b33de84679b78
- SHA1 07506b030858869e11e696bdef19bf5d2d06e7d2
- SHA512 b12b29f88e34c8b508b68b86c504fb9ee9b400dde7c8928b361f0ce18feff3940eaeb5ca4ded5cb23fefbcc29c7fdab8e79d22106c2b4a36e6337cb598f2805c
- TLSH T10341CEF783B4857ECA1196F4EB116E1FCE690525032C3C6289D4AE1B93F2972E14078F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cd52a784-1dae-4f24-917a-95a0704bb7ac.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a8df96da-8e72-4ff3-87c3-c7659ae8e622.tmp
- Size 414B
- SHA256 5ff903e720b833e0ee88f50806d6f821276365743802a5831a0e15ad74b078e2
- MD5 c3d96c397f5a104a3bced1f15e66eb09
- SHA1 03a30a34b8706030d7d5bc6f4f898a327a4110bc
- SHA512 797eb3855a0bedac51ef39f2d004d6a18e6547b44c20fdf97184e5a157cf1ac05fdf6e2945b447b63eb5772f58ffbc8bd5653b13ab822bf88d566f4e9b1bc496
- TLSH T190E022A9C826E86718FD875964640382F745136726E1898F7A3D86098FF863A918A85C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cb57c1d3-1cd1-4732-83f4-e68c886e0635.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f97d93a6-f2c8-4324-bde7-b8fbadf6e420.tmp
- Size 12KB
- SHA256 46158539eeb1fd0d621a70402f2ccb9176fcc973ef7a8b8c46684633f3497f5e
- MD5 30f420d218476f7debff6eefdd538e42
- SHA1 0389fab29e12f4d93706e1f04eb67323745073c8
- SHA512 9bdddc2168fe376406598dace30eeef6f2fb27265059451ac7644d31f5f3244a1f183d130360c00d68002877151cc876ff861d28ee317e4f72e673cbc32385c9
- SSDEEP 192:XR9abTMtv73pFPRp9849vHsb+WNn9i4Smd2Mk9XH/kq9VyIsnAUgE:XR9afMNbbXjhwU492l9XHdE
- TLSH T1C6429529BD50697B5DDBD22AF9227B53D3F5202224A42EC4EAFDC92C25E79CC2127407
- MD5 SHA1 SHA512 SSDEEP TLSH