hxxps://cryptex-core[.]net/pages/download[.]html

Resubmissions

25/04/2026, 07:49

260425-jnv9cabv4x9

25/04/2026, 07:22

260425-h7qbrsaz214

25/04/2026, 07:14

260425-h2vz3aax9w4

25/04/2026, 07:10

260425-hzdyrsaw7t4

Analysis

user interaction
yes
max time kernel
179s
max time network
187s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cryptex-core.net/pages/download.html
Sample260425-h7qbrsaz21

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3208	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215753978863592"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\cryptex1.4.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
4648	chrome.exe
4648	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe
Token: SeShutdownPrivilege	3300	chrome.exe
Token: SeCreatePagefilePrivilege	3300	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe
3300	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3744	3300	chrome.exe	80
PID 3300 wrote to memory of 3220	3300	chrome.exe	82
PID 3300 wrote to memory of 3208	3300	chrome.exe	81
PID 3300 wrote to memory of 3220	3300	chrome.exe	82
PID 3300 wrote to memory of 3944	3300	chrome.exe	83
PID 3300 wrote to memory of 3944	3300	chrome.exe	83
PID 3300 wrote to memory of 3132	3300	chrome.exe	84
PID 3300 wrote to memory of 3132	3300	chrome.exe	84
PID 3300 wrote to memory of 3884	3300	chrome.exe	85
PID 3300 wrote to memory of 3884	3300	chrome.exe	85
PID 3300 wrote to memory of 1604	3300	chrome.exe	86
PID 3300 wrote to memory of 1604	3300	chrome.exe	86
PID 3300 wrote to memory of 1692	3300	chrome.exe	89
PID 3300 wrote to memory of 1692	3300	chrome.exe	89
PID 3300 wrote to memory of 3904	3300	chrome.exe	90
PID 3300 wrote to memory of 3904	3300	chrome.exe	90
PID 3300 wrote to memory of 3432	3300	chrome.exe	91
PID 3300 wrote to memory of 3432	3300	chrome.exe	91
PID 3300 wrote to memory of 4464	3300	chrome.exe	92
PID 3300 wrote to memory of 1216	3300	chrome.exe	94
PID 3300 wrote to memory of 1216	3300	chrome.exe	94
PID 3300 wrote to memory of 1872	3300	chrome.exe	95
PID 3300 wrote to memory of 3416	3300	chrome.exe	98
PID 3300 wrote to memory of 3032	3300	chrome.exe	99
PID 3300 wrote to memory of 900	3300	chrome.exe	100
PID 3300 wrote to memory of 4648	3300	chrome.exe	101

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cryptex-core.net/pages/download.html
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83575c728,0x7ff83575c734,0x7ff83575c740
  2⤵
  PID:3744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,14178239397579402040,5312532419511062136,524288 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,12057959686027751083,1219487919290631967,262144 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,12819174721090648703,16728405666525695551,524288 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2432 /prefetch:13
  2⤵
  PID:3944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,537596917495215348,11006363687605635566,2097152 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,17868791962848069094,1155836880575900539,2097152 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4204,i,10850849164598648543,7952078175875098856,2097152 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:9
  2⤵
  PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3836,i,4142166596530358225,6091426066745705972,2097152 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3304,i,6758909583709855405,6420780124936238805,2097152 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4660,i,14997798819350496839,16506257436206561077,2097152 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,8751347020201563426,3640472875780544664,524288 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6008,i,14927122036899045522,5853463834333725566,2097152 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,3082555914614988885,4101852733096527600,524288 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4524,i,7159610986251466593,7877423152239997142,524288 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3376,i,11030198118219410085,11604041827744380887,524288 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,10280365161362410561,4796165192139983400,524288 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5720,i,956598467995520461,15787605214795464964,262144 --field-trial-handle=2024,i,1527546495135258829,11780492512912163574,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5672 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d7dd5626f8670f13e5199bc1973fa0f218f33a710124d585b192c1c1af4751af
MD5 79558833e574736701ce23161f31b7c6
SHA1 ccf85524bdfeb9fefc5baee48b7e277896e5287c
SHA512 8dcfb4a99ad3a72f5e065a87ffaa3f596d7365b440dc9b7d80d7d15d84c1b8537feaa5b15ae804d2c90dd2f5348978c65b62021fac2474cc243241fa709d3b10
TLSH
T186E02BAACE21DC2B18FD0B1960544785E70003172B40855F3A3C810D8FF127B06D5C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 466f258aeaaef39ed48dd9321f5ba29266ed6228b7aa1d2312ca22dd6bb29b50
MD5 d674a870ea21c85e6e8a461993c7a4f4
SHA1 1486fd95e4e8008cfad7f6b8a34f7b2d58ae1cbb
SHA512 e78e06bd00dc87926f88f8f0e89b9aaf49cc07a48ac406f151d7d620ea3e47c25faf8d73d4978fae4e99dcad6988375d80afe44b3bd8e9892d534f43bb234113
TLSH
T1D8C08CB191E0C102E79027B80CC50C226EF216314B03CEB2C2D40528FA836BA3086C90
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6670bde9effcfd4a1a61316e2888ebbb89bf720b7bfe9af2dfc8c254256fedd1
MD5 912780be7dc149782943bc1addc21832
SHA1 fb162d27b87e741a4749af3606af0405933b911d
SHA512 512b9f9d6943469fa3b517496576ee77badfef645aa01bb757c52f4df76b2b9fa45bf2aece79709495835e16426b3321a0ea8e566598625fccbca0a35fb69dae
SSDEEP 48:YALlqXSQSLSQ0SxFhSFaXYfo7Eg7osagmzsQ4snGS8sJSQsHShsoSNzsv/SMsMSn:Dusg+QaIaEg7KLnGi+0f/R3o1
TLSH
T152917EB783F8CA6E891156F4AB246E2FCE2D0D14536C3C5689D5EF0B93E2471D24065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 623c266c8d56fb5112fc1dda52efabf2f1763b42015c7f578953e1af8848793a
MD5 c0e0a2116ec180550e1130c59179d3be
SHA1 d326cd8fadb8411a2ad89e26beda6fc014675f2f
SHA512 1c6af3b000eeade08edd10603bb955ad29810b340cc3334ddba0602beae2d4ed79a5f000828236b543778b68470dfe6dbf72d325f25916466901bbc42b5b21d3
SSDEEP 48:YALlqXSQSLSQ0SxFhSFaXYfo7Eg7osagmzsQ4sJSQsHShsoSNzsv/SMsMS6sYS8S:Dusg+QaIaEg7KLJ+0f/RJ8D8pfo1
TLSH
T1AF917EB783F8CA6E8A1156F4AB246E2FCE6D0D24536C3C56C9D4EF0B93E2471D24065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 385e6df4b1ab938345317be796f01fec5762d4d10ba5aa0adb01fab486c974bb
MD5 1f79f5e35187162e9e2440e3d24d3ce1
SHA1 76bdbad09ffeecde55f1c24b7b6b7003cfbfcbc5
SHA512 4ea95197db04036bdb984d395e65b67c051e5e399e4ad8af5f6baa39f3bd062919fcd05fd7133add5383aa4f13e1160b7090dd444c07a1f0d35cf02e7182486d
SSDEEP 192:NRuibuByiZdOgOev7dpOPRpw7Cq9ZHsb+WNnsIM+lYg2JjVkwWCvVyIsnAUgE:NRPbuBBSapGXyHwrnYzJZVJE
TLSH
T1D852C62EA914693F4CC6D619F966BB17E7F5102165D02E88EBFCCA1C14E79CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b2c24bd3244d26c923fc39b91f5a5adc64ced7cd34e422cbc88975cb0e30e0aa
MD5 1169454c0f5e17c2a026e85c4daa4f75
SHA1 79f6990a7e3b6184094dd1afdc19dc8402196ab0
SHA512 f327e578280bbfa7a4613d507f1fb8f73377b333cb19ae4be23f6f1e1698eb9c30918d864d713bc50e9dd1587d702ac4cfafcc0be51dbbac48f8a07dc7eed231
SSDEEP 192:NRuibuByiZdOgOTv7dpAPRp27Cq9ZHsb+WNnsIMm12E2JjVkwPCvVyIsnAUge:NRPbuBBSrpUXQHwrD2PJZ6Je
TLSH
T13042B52EAA14693F4CCBD219F966B717E7F5102175C02E88EAFC8A1C14E79CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 74023b783b19914491b79af2a1f5909d234a194c68877be30620883aa987c75f
MD5 1d342f4788002e5c9dd8daef4956c6a1
SHA1 f023443707a13336bc30f04096737010e02c8648
SHA512 70a90ecbd3465c31be0a38c0b781fbf943dec6e9b5befa0fa62b03a424670a30141967f5d10709ac8628f3b828dcdb5306a90645cf6525b275f004690fe8e28b
SSDEEP 192:NRuibuByiZdOgOsv7dpAPRp27Cq9ZHsb+WNnsIMm12E2JjVkwPCvVyIsnAUge:NRPbuBBS4pUXQHwrD2PJZ6Je
TLSH
T1B342B52EAA14693F5CCBD219F966B717E7F5102175C02E88EAFC8A1C14E79CD322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f58f97ae0147f62523cce0d4893dbb6cfde573ed5cd4a9e5049a20330aac67f5
MD5 1b06ed709dbfa904f4c26ba5bea2eb3c
SHA1 c981895837a5d70ea38380c388b447b075f1f116
SHA512 73579f001f1e9feda7fda36d4feff5e8a96e9a59d285569c1950544813d1321c129cf91a5641be25a2cebb9786f5b8832d6ead1da87635ca2cdf1de8004823a6
SSDEEP 192:NRuibuByiZdOgOIv7dpOPRpw7Cq9ZHsb+WNnsIM0jee2JjVkwWCvVyIsnAUgE:NRPbuBBSUpGXyHwrDehJZVJE
TLSH
T18B52C62EA914693F5CCBD619F966BB17E3F5102165902E88EBFCCA1C14E79CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3b718a2affd0b9b5364071beebd2b34679c34decf9c71301947f71ce406a4170
MD5 a2bc26301ce603324437cc7ae60cc03c
SHA1 a4a24de7b4c5b846ae08fcb0a33e41ec9e6b7c05
SHA512 ac0af28b28d89f8108ed82650b154dc64a7205b9232cc270e99aa70ebcf9501912cf31db7e689099306945a34e91edd832f70bcb427edfb291e99b00eed3d4cd
TLSH
T1F7B01250C0419511C08703B51183048831646F109705270163E56D71DC7E5A15014151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aad1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58aad1.TMP
Size 96B
SHA256 b21d1e936dbd7c4fce6fff8081dee9b4f0c8b15f07f4918161d5a5d353fe85b8
MD5 2f60167485785c94e68c8fc186e37702
SHA1 a6060c61b1536637d359f29aa8abbef3b7aa0bea
SHA512 e2535e7f908b036c96769e8f3ad1acd26162d959517e2f0921e4ae31abf092eccdf13e17ad52ee443b47c1ccb273959c7b829ac842460e69c5c0e9a616987f7a
TLSH
T1F5B02200C002E223C00203B02280A2CC3020CF20C203022282F00A23EF202322222020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 069043ab36de4a7e749c23818dc98a1ddd685e471f3c1969efb826237578781d
MD5 d8e77cadafb6de6572c8f7e4fe242344
SHA1 b27079882ae8b0a0d4d420829f3413e7498e8818
SHA512 f7aa85e1fae3724937d090e9755a4c4e7a3f08fed046e5c8dc6ccfaff95a90b2504013da7a35675cf440698752f839959a197f555144616294deb1ac60d2569c
SSDEEP 1536:7UP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:O++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1C49302FD991E7C7953ABD6E690079CAC8CE3CCCE1514157C31C76B0E10BA3A2A35B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 64f7b4ea5af6ba1ea8b508e2135fb5985c7e964ccfb03d21aaa306d97de57ac0
MD5 ce3dd7cd734dcd64b3755946b33ab685
SHA1 34dd929c603c56dd70b2260cb32ea60cba489b8f
SHA512 eab28584ae7ef85e2e860586ac11970167aca21e985e416e54967d2827b7155572b0f3661254c1d334abed0c9c0a70dbc87d5a1ea832f5ff7ed7122dd8980c43
SSDEEP 1536:XOP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:U++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1BF9302BD991E7C79636BC696A0079CAC8CD3DCCD151451BC30C76B0E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 c6607cc19e55602b61055ee26489dd937775535ef6f3dcbba745d3521df678fa
MD5 0693a4090467dbfc3efdf1e75d1a8c87
SHA1 23405f361806605ca28f393069ea43798d8d325f
SHA512 d81fbbc6d42b770eb031af3f6b7adecdefe467f51dda08349defac26b8363fc576e1e95835e3b610ee8d54b6ea3cf4b0dff545467bdf92778c23ac1c804a2fbb
SSDEEP 1536:cuxmuP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:19++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1099312F99D0E7C79239BD6A690079CAD8CD39CCE1614157C30C76F0E14FA3A2A35B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 f10ad4e313b44c44f9139eb0d4d5e596d44cea7f5dacab8cca167def6f36a16e
MD5 f0e1e8ce312b725b4a4247649b85ebca
SHA1 b828d79af87d508c0883d4132f66c2f731b39e08
SHA512 420341412892e5817728ca77fc3edb85a895ec43a5bd4f93baed6092e86eec9353f83b5b33adc2fe5f4be7e87f49b4f480787bf4192111a40e263d64235d04f1
SSDEEP 1536:7uxmuP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:U9++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T1E99312B99D0E7C79239BD6A690079CAC8CD39CCE1614157C30C76F0E14FA3A2A35B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cryptex1.4.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\cryptex1.4.zip:Zone.Identifier
Size 140B
SHA256 ac2751011ba9802194ee574ab77c9d3a03b04447155c6530582e69e365c2af29
MD5 0f11057a8a9019b1b79640ef7f821994
SHA1 8ea0d82a9016b4aa9e82730e280295c0daff1ae3
SHA512 60a5d6363abb75d9a0d9ba660149682a6012d6e88db2adc821782bcd325d3b612cafbff070caf74b8eaaa0c82f5f6488efc6545a4e95901b4d86f6125421f446
TLSH
T193C09B7B8D0886054701A1E835BDD018B10B77050997D741FF5005DBE5541D4DAD5757
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2536-13-0x000002BB95D30000-0x000002BB95ECA000-memory.dmp

Download