hxxp://url1137[.]crypto[.]com/ls/click?upn=u001[.]a3rDJB2v9y9hAhzyhYB5oEJeKgH27Eeuxg9uYPT74x6ykMMQUFGQ1w1M95rcb4sA5x2ykt305xrqc4MIxhs8nw-3D-3DtP20_LTwXEKAqPk-2BOZ-2FgPXg9pIZcQqEe9hqYB-2FDwrNFTbQuSINIF89t5di-2Fc7cZwXl1-2BKerOn8Si-2FoilJKbkw2CyhRginRmM2fTZK5gUUIXL0XJAgosjhHU37n1EAmm888VwY8tzLHxtKx6PHGoEZVzTQ6EmxmaaGWqb1zPc0Q9QNvkGJXgeT3uqlIuy-2FKAFSGb2tP-2BmIgeCkr6j-2B-2FyzjwktNTg-3D-3D

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oEJeKgH27Eeuxg9uYPT74x6ykMMQUFGQ1w1M95rcb4sA5x2ykt305xrqc4MIxhs8nw-3D-3DtP20_LTwXEKAqPk-2BOZ-2FgPXg9pIZcQqEe9hqYB-2FDwrNFTbQuSINIF89t5di-2Fc7cZwXl1-2BKerOn8Si-2FoilJKbkw2CyhRginRmM2fTZK5gUUIXL0XJAgosjhHU37n1EAmm888VwY8tzLHxtKx6PHGoEZVzTQ6EmxmaaGWqb1zPc0Q9QNvkGJXgeT3uqlIuy-2FKAFSGb2tP-2BmIgeCkr6j-2B-2FyzjwktNTg-3D-3D
Sample260803-jv136styey

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	sites.google.com
12	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2116	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302176217282217"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{63B3FA7F-5C7B-4158-BAD3-1E53134866BB}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
4772	chrome.exe
4772	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe
996	chrome.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2936	996	chrome.exe	85
PID 996 wrote to memory of 1620	996	chrome.exe	86
PID 996 wrote to memory of 1620	996	chrome.exe	86
PID 996 wrote to memory of 2116	996	chrome.exe	87
PID 996 wrote to memory of 4880	996	chrome.exe	88
PID 996 wrote to memory of 4880	996	chrome.exe	88
PID 996 wrote to memory of 5028	996	chrome.exe	90
PID 996 wrote to memory of 3796	996	chrome.exe	91
PID 996 wrote to memory of 5028	996	chrome.exe	90
PID 996 wrote to memory of 3796	996	chrome.exe	91
PID 996 wrote to memory of 2152	996	chrome.exe	92
PID 996 wrote to memory of 2152	996	chrome.exe	92
PID 996 wrote to memory of 848	996	chrome.exe	93
PID 996 wrote to memory of 848	996	chrome.exe	93
PID 996 wrote to memory of 1576	996	chrome.exe	94
PID 996 wrote to memory of 1576	996	chrome.exe	94
PID 996 wrote to memory of 2420	996	chrome.exe	96
PID 996 wrote to memory of 4612	996	chrome.exe	95
PID 996 wrote to memory of 2420	996	chrome.exe	96
PID 996 wrote to memory of 3704	996	chrome.exe	98
PID 996 wrote to memory of 4744	996	chrome.exe	106
PID 996 wrote to memory of 4352	996	chrome.exe	107
PID 996 wrote to memory of 5080	996	chrome.exe	108
PID 996 wrote to memory of 4772	996	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oEJeKgH27Eeuxg9uYPT74x6ykMMQUFGQ1w1M95rcb4sA5x2ykt305xrqc4MIxhs8nw-3D-3DtP20_LTwXEKAqPk-2BOZ-2FgPXg9pIZcQqEe9hqYB-2FDwrNFTbQuSINIF89t5di-2Fc7cZwXl1-2BKerOn8Si-2FoilJKbkw2CyhRginRmM2fTZK5gUUIXL0XJAgosjhHU37n1EAmm888VwY8tzLHxtKx6PHGoEZVzTQ6EmxmaaGWqb1zPc0Q9QNvkGJXgeT3uqlIuy-2FKAFSGb2tP-2BmIgeCkr6j-2B-2FyzjwktNTg-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff811bec728,0x7ff811bec734,0x7ff811bec740
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,4153332200054857211,6669757760441958627,262144 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,3777271676826850898,7496785127141136587,524288 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,15686824562806826132,10826902250018559214,524288 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,10515129699174184559,14697568585026498249,2097152 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,15623963782205149917,778904536348097233,2097152 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,16245735477221939210,5923219691171291286,2097152 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,8124427484229219295,7192846725404916004,2097152 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3304,i,15242249817932739393,4451269435530468362,2097152 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4984,i,12466442645926278214,12381717519995094860,524288 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,6816624270957235475,207244368118617546,524288 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,5596346599361234151,8975330392376168099,524288 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,4729661909888538282,5771493907576156568,524288 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6196,i,8079013613684113150,4908312181241779457,524288 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,6542754294003771993,1502456105591188395,524288 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6012,i,17024383801196733935,3501620736558614976,262144 --field-trial-handle=1924,i,14680630831792447149,6319854592056853168,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d9268382988d37f7d5e82ded707311c1c9d50d84b608dfc7ca6bfacc9a2473a3
MD5 66b0f03ca3744d2e96eb445563f4fb61
SHA1 23239dc4782797cbcabf616fd96d5eb1d7366579
SHA512 89516e380a94199fb9b299c72836f321b5bf482aefaf4406efcd4948f12021b8d885b72a8331fbd15fcedb6c57611d73961a47bc909d5ce657a25b12dd9cb19e
TLSH
T170E068A9C966EC3B19FC2718A8654B46EBC2A3172640DC1F373D910C8FB473A8686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 b06d6aa9fd3ec2997a652fe47861fd361ce8f25c9a724660e184f72d692d9d54
MD5 dffba17eb7eb19f195c1362c2c2f218e
SHA1 04fefe0db52cc3442c942d8824208ca9ad6022a6
SHA512 82f36d74e4b046ed462881d34f8b8e7ea59d4fc5b4ff0fb7887879b224e2f246afa49bb7eff406d0fee865a4545dd60a6dc12fab4435ab719cfb062141088025
TLSH
T18CE02E60CF02011EC7082B330C92AE68E103207EF7EFB34810B00874E66562CFB33026
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 772fa41e0ec7e9b16f60a141e93b5726093eab3296c1b6aa2197f84411c6a595
MD5 29db1348974069067bf115851ea162b9
SHA1 923be432645e056dff9e85d6dfa5a4fa5bfa070b
SHA512 27925890534577e3706c7eba42ccbd73466898a421f57661a735cec13c82f848b0012decbfa862c16cbc25df2d1addf6858ff712a292844ff519de72f9d65884
SSDEEP 48:YALlhnnhbfh+hHDhL4Rafo7EdKsdDgmzsDRXsd3dsd7VtsdGqzsdP2NsdrcsdXUk:DJRfkZ9gaaEdH0iiVbp2maC3a/aR
TLSH
T107918DF7C3E8C92D890156F4EB166F1FCE2D0A28432C3D6AC8D4AE1B93E2871D11565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ac12b6579beed6325f031f1afed876cd33156cd8a1a125f7e965945958c76bfa
MD5 c5d3f3adc457485c5d8ccd4b08524ceb
SHA1 36583d322f2772c1b13e5b058226db2360db8692
SHA512 c0f9313aa0ab301fdb828e07764b441d42781f0d20a8834652f3ea928c62dab7fe971b33b2ad2358394b7b9b047fbaca1146ba1a2604290cc904b9f5b88e4898
SSDEEP 192:FRJ570QUNRv7BF+pAPRp2G+r9HHsb+WNnrqQXb2QcDalmNnqVyIsnAUge:FRJ5ofBVoUXC1wmi2zaCqe
TLSH
T1AF42E62AEE15797B6CCAC229FD26BB67D7F5102121D42E94E6FD892C10E76CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c1b654383a2d4db77436501d7ed59aa5f663916f4f02ad31a6168c0c7602417a
MD5 3e694b37359aee36aa0324916748e8f5
SHA1 2a82cba2f230cab7c9f9a230d34cabd106c7edf5
SHA512 6504e0c2ab4995f879a8becd026a446a6d1210f6afd75b00f9d3d6aec211514b3a6af8123eb70ec21af95912a2823b0947eb28a64781c50564031d137c18e509
SSDEEP 192:FRJ5v0QUN9v7BF+paPRpcG+r9HHsb+WNnrqQhJeYcDalmNnAVyIsnAUgE:FRJ58f9Vo+Xw1wmiebaCEE
TLSH
T16B52E52BED15797BACCAC229FD16BB67D3F5102121D02E94E6FD892C14E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1c619e9a29a2630fbf55ce76702fde8569299b1f8939ae1e06c41b67112a1b2e
MD5 eea08056ab69a5cd50724a5d13b278fa
SHA1 841ba3dc26be9cdf2f7ecc8aa20b599153580b8d
SHA512 e04c5a58e0de55ce0d445af4c90570a88e81345688f14401dd63f1775f7a0a7146f5305a36e300a675cbe743f017b287137cf76c4d12b01ec920532bcc2e2f55
SSDEEP 192:FRJ570QUN9v7BF+paPRpcG+r9HHsb+WNnrqQhJeYcDalmNnAVyIsnAUgE:FRJ5of9Vo+Xw1wmiebaCEE
TLSH
T10C52E52BED15797BACCAC229FD22BB67E3F5102121D02E94E6FD892C14E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1290d5b9d7fd285a5f5379a522d411c8642c52d044ceaf92a585f91856290baa
MD5 37036e436031d3d42414e346c45e2dcb
SHA1 00731ce2fd9a54aeae87c3b20fae41d1f5eb5af1
SHA512 c2312314bc07135932ae98ca60ed9fc83d2c784023665f7a63449964c123e14cd6404493c2090ace8bb0321168aad1614ea7932aa7a4c408d84ec45283c13c61
SSDEEP 192:FRJ570QUNvv7BF+pAPRp2G+r9HHsb+WNnrqQhJebcDalmNnEVyIsnAUgE:FRJ5ofnVoUXC1wmieYaCAE
TLSH
T15952E52AEE15797BACCAC229FD22BB67D7F5102121D42E94E6FD892C10E76CC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e4b6d1ec2c2aa7d4d47e811f69e7f6563494735532f9bc09b87a536a78ae55b4
MD5 82e30333ead36eb711cfc720cb50042f
SHA1 045fa57b3c65426cd396413c7afaace316c9f6d9
SHA512 2ed3a515dc9b1aa06b25dc3966bb504a8d5212cf85493948dd276ecb812e7faeb4b30ffbdba58e3ec9ecd17f896b53df48b379db87b779dedde84329bd533473
TLSH
T15EB0124184016541C08303F622826488F114DF14BA0A171243F06A32C8392508019050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5890d1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5890d1.TMP
Size 96B
SHA256 c1f2af9c5f2eeb873572133e7866ac3e06d053fd833a81b5436f1174ce8452d7
MD5 89b1a7e9e4e912393242e2b01fbf3818
SHA1 de317749a810c4973ecf7a5a1f37e995e3aa1d08
SHA512 495ce29786ee04f7778a708efb83611b6ad9c497fbdf913e17bbd6836cab738a5efb687242f1a0f8793d169ee47f7aa93dba3ee7fc780b7adb51358300b3dddc
TLSH
T1E0B02200C3022282E08203B028C2A0C8B020CF20E2830202C2F00A32EC282200220C20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2c3b422ef80e5c7fc3ecf85d20ef501d01de790739fd93034bfc1f4ade3c4f08
MD5 2d242d02913513274fa7a1d9c5f910f9
SHA1 1b7cd3258d3696952f7998fe232f2148fa36d8eb
SHA512 28601b15c348345018c0c74c484d88a23a4d2a30bd682f1f51dc251bec998842cb233d66ab199c15a90504a7ad765ec8990df177c379123513580ef7ee1c4d4b
SSDEEP 3072:D+Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:DZm7Rkm1tYpBeh2BAoM
TLSH
T1D5C302379D75A83758B9BB5EB08E0A1F1EF24A67D820DE52C8D85B0433F97CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 5cb4058f895eedd653d4ab89fba3a7a5168fc90f61645df4012060f86e0d64c3
MD5 aca77500f2982021d373c589efa280cc
SHA1 4cbcd0c5e8210d6a9c7c03793f8e2a88dfda6124
SHA512 9f2d05b3ea91235379ea00d89e7bef32fa6c28a5e51fb5f609a10a22770372d032d00dc4a3c2c6121e57321eb9688535dcfd88ef586fe7ce2e7cfa59bd7be4ae
SSDEEP 3072:/VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/8m7Rkm1tYpBeh2BAoM
TLSH
T189C312275E75E8375878BB4EB08E0B1F1EF14AA6D830DA92C8D86B0467F97CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8f63d41ffd55124df230f7cf0e9a6b9083c82b987c9a4b76eeab567b48826a94
MD5 aae5fec78ca64ca7be4747440b691771
SHA1 74bae7a3d0a73fba6c68d469244a3a0763a433d6
SHA512 92ae8d13ecac902c5e80bdde40bab0393caa0cef74a7bec194e2c244138baef6eefe7572f487db85e73b1b0821d27496aafd50b8cc4c8322e89ae6c54f356b38
SSDEEP 3072:DVGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:D8m7Rkm1tYpBeh2BAoM
TLSH
T1B5C312275D75E83759B9BB5EB04E0B1F1EF14AA6C820DE92C8D85B0433FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 42856646ad1f04f903b250a0cfe87c90eaba5cdcf3b4abe8492bf4e9653de423
MD5 81b6fc3e77fae234cd3f2e4bd6784d70
SHA1 6f0539e1b268e80bae84714ee4896ab9617921e8
SHA512 629fa71ad4a1cfcfc73870b3e49f7ad5556adb48eb312940b531f50d13290764e31d3283f0135b7e5389e575a7cbd56c05bcaac121c3759099b552250b73e282
SSDEEP 3072:wVGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:w8m7Rkm1tYpBeh2BAoM
TLSH
T165C312275D75E83759B9BB5EB04E0B1F1EF14AA6C820DE92C8D85B0433FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download