hxxp://url1137[.]crypto[.]com/ls/click?upn=u001[.]a3rDJB2v9y9hAhzyhYB5oH-2F9xKf-2FLW1I-2FpzD5ZWxcs7ZsMVn6QbF6rWgQAa6zKualquo_uXBwW983eSO4JQxjq6HEN59BZebALAu1jNaCq9MQujHgKIoFTCsOCOHUIC8j0pl-2B7Oih8DsCHEpKR4UejGpZbvCF-2FQ-2FqSfiK1MGFYHXRxAXdJiysqq585AgQZ5b3oW-2FguD201a5FqKuKOiVC04BtZMgzWYLVDdy4vluCCDmo5wBbS5LHJXVp1C4EwTzaCqy3y2L0wDdXk66qdzoOrXX1-2FaLHkqmhvjsaJ9bt3IH8cj0du3sC1YnRAM0Qr5HfJBFTRvOFF-2FejKwH-2B-2BZStUPhpHubWWQTlvOcYUHsu7i1lJfAku6ZUJve8oTRFN8TZMWpqRxPLy467QSdkXAyCD5H33ChNbqbtXaGKF2a4a4dNNGVGAFEdk1m7xS4fD9S7eu6d9KEixlrSfELeq-2BjOa2gI73pG7ufPUwLTBhp-2BP4k1ax7S9UQ-2F6a5bMqgateM2HvrWsTpxMrybSXCpglyoUJGzy1FfeLfAg1ttTI6hthZKMLNXrCeCBsx0tsjCV4P6X0YTrHavPEXphkIrhHG2T2AmZg-3D-3D

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/08/2026, 08:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oH-2F9xKf-2FLW1I-2FpzD5ZWxcs7ZsMVn6QbF6rWgQAa6zKualquo_uXBwW983eSO4JQxjq6HEN59BZebALAu1jNaCq9MQujHgKIoFTCsOCOHUIC8j0pl-2B7Oih8DsCHEpKR4UejGpZbvCF-2FQ-2FqSfiK1MGFYHXRxAXdJiysqq585AgQZ5b3oW-2FguD201a5FqKuKOiVC04BtZMgzWYLVDdy4vluCCDmo5wBbS5LHJXVp1C4EwTzaCqy3y2L0wDdXk66qdzoOrXX1-2FaLHkqmhvjsaJ9bt3IH8cj0du3sC1YnRAM0Qr5HfJBFTRvOFF-2FejKwH-2B-2BZStUPhpHubWWQTlvOcYUHsu7i1lJfAku6ZUJve8oTRFN8TZMWpqRxPLy467QSdkXAyCD5H33ChNbqbtXaGKF2a4a4dNNGVGAFEdk1m7xS4fD9S7eu6d9KEixlrSfELeq-2BjOa2gI73pG7ufPUwLTBhp-2BP4k1ax7S9UQ-2F6a5bMqgateM2HvrWsTpxMrybSXCpglyoUJGzy1FfeLfAg1ttTI6hthZKMLNXrCeCBsx0tsjCV4P6X0YTrHavPEXphkIrhHG2T2AmZg-3D-3D
Sample260805-jwss7asdpc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1200	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303905073126147"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
1788	chrome.exe
1788	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe
Token: SeShutdownPrivilege	2108	chrome.exe
Token: SeCreatePagefilePrivilege	2108	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe
2108	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2508	2108	chrome.exe	83
PID 2108 wrote to memory of 1200	2108	chrome.exe	84
PID 2108 wrote to memory of 2780	2108	chrome.exe	85
PID 2108 wrote to memory of 2780	2108	chrome.exe	85
PID 2108 wrote to memory of 3700	2108	chrome.exe	86
PID 2108 wrote to memory of 3700	2108	chrome.exe	86
PID 2108 wrote to memory of 788	2108	chrome.exe	87
PID 2108 wrote to memory of 788	2108	chrome.exe	87
PID 2108 wrote to memory of 4120	2108	chrome.exe	88
PID 2108 wrote to memory of 4120	2108	chrome.exe	88
PID 2108 wrote to memory of 4952	2108	chrome.exe	90
PID 2108 wrote to memory of 4952	2108	chrome.exe	90
PID 2108 wrote to memory of 4084	2108	chrome.exe	92
PID 2108 wrote to memory of 4084	2108	chrome.exe	92
PID 2108 wrote to memory of 2600	2108	chrome.exe	93
PID 2108 wrote to memory of 4920	2108	chrome.exe	96
PID 2108 wrote to memory of 4920	2108	chrome.exe	96
PID 2108 wrote to memory of 5092	2108	chrome.exe	103
PID 2108 wrote to memory of 4680	2108	chrome.exe	104
PID 2108 wrote to memory of 1040	2108	chrome.exe	105
PID 2108 wrote to memory of 1788	2108	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oH-2F9xKf-2FLW1I-2FpzD5ZWxcs7ZsMVn6QbF6rWgQAa6zKualquo_uXBwW983eSO4JQxjq6HEN59BZebALAu1jNaCq9MQujHgKIoFTCsOCOHUIC8j0pl-2B7Oih8DsCHEpKR4UejGpZbvCF-2FQ-2FqSfiK1MGFYHXRxAXdJiysqq585AgQZ5b3oW-2FguD201a5FqKuKOiVC04BtZMgzWYLVDdy4vluCCDmo5wBbS5LHJXVp1C4EwTzaCqy3y2L0wDdXk66qdzoOrXX1-2FaLHkqmhvjsaJ9bt3IH8cj0du3sC1YnRAM0Qr5HfJBFTRvOFF-2FejKwH-2B-2BZStUPhpHubWWQTlvOcYUHsu7i1lJfAku6ZUJve8oTRFN8TZMWpqRxPLy467QSdkXAyCD5H33ChNbqbtXaGKF2a4a4dNNGVGAFEdk1m7xS4fD9S7eu6d9KEixlrSfELeq-2BjOa2gI73pG7ufPUwLTBhp-2BP4k1ax7S9UQ-2F6a5bMqgateM2HvrWsTpxMrybSXCpglyoUJGzy1FfeLfAg1ttTI6hthZKMLNXrCeCBsx0tsjCV4P6X0YTrHavPEXphkIrhHG2T2AmZg-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fffd490c728,0x7fffd490c734,0x7fffd490c740
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,13976539212063581947,6461234803854262536,524288 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=504,i,14236779975269792658,12342338266271407687,262144 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,15796162379691589758,11701365298232632171,524288 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,16303653811139036132,17805290542792330848,2097152 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,9850515062984741506,8300313102794402149,2097152 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,16765504711045974700,7439279168315686677,2097152 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4436,i,15473017096039909492,17856546189321943430,2097152 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,8998820321657319543,18390575747938483035,524288 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5788,i,12247140655756638793,2219072665160513597,2097152 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,7999285669734928127,15909813689970140037,524288 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,805030583591966582,16850462191976431473,524288 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,12492359051350774142,5954237465363309415,524288 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6080,i,4905260015027252781,3318886122775405625,262144 --field-trial-handle=2024,i,17010306124603962376,18058583757483707758,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8f171d71ad97e4e825081aad534cdbe36065c5417cc457d78594ac519911fe23
MD5 84fab5486f16bc845862926feef9903e
SHA1 c81645af17a1a6d24bbd97699df429489ba3c01b
SHA512 1704d7f943c4c89e61aeec22e48f85b6eea8bec6809bad22ef376bcba9a5ddde26c7a1a86125b547c03ebe46776b520ff065e31a3cae33f9b51bd2e1cb199482
TLSH
T1A1E022AAD866EC3B0CFD4B1914100A82EA9023166A50891B3A3DD20C8FB167E8186E6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 489a8b16864ba04b5308fc2371e9d2a4f5600c3d6db081dd2702ead48a56d798
MD5 44c7aac4ef39200425bdbd52ef97f805
SHA1 14c6824870cdd01999d4a44d9921c667b8a3aacb
SHA512 ab12ed341f2dcc12f071ca173487a4bde02c579e88e85f6535928a0244b2a2702962fd18068a95bae1e40f5209b25f0aa196a5c85925aa5489585a3e900fd6f6
TLSH
T1B6E02E02A0802C4BCBA8C3F451FACF6371F8460800AEEEEBB2E502BE042B3D42030C02
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 91d9c4d4d17556c77887cae5b22d28bf401e1fa97c13ad076e479f8f2d742835
MD5 ed91a74509041f3acb1e2043e013d2f6
SHA1 4860b16254d3db8241a14bfecdede94200c4de68
SHA512 f4b2e6149bd707584b74cbce818ff91b40c02c09c175bed8535512f8cb7a289962d4ae390ea890048cdd6db850c39614d42d58b5319a1bd85d709a9b77b3be74
SSDEEP 192:DblN2fAQaIEadLyoxS3p3NggZtuz46xyBbH/:DblN2fAQaIEadLyoxS3p3NggZtu86xy9
TLSH
T122D17DF3C7E4C62D9B1156F0AA24BE1BCE2D0A24432D3D2689D57F4B93E2471D111B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dd4ca82c65c68e0b07d85bdf7c7e5908a9e45f367ae70bd118bb9fbd78474777
MD5 fa3a06b94c48195cb8a893db02db7325
SHA1 020310c10bcd7b170a1a14e387ae5ded5bbd29ac
SHA512 d888126b785fe07608918583726e18bda0895f77fc3245e12dfc47ab998ef5753b33249b35af541c86ab5925376187b0042c87330e6b6b2001936c5c6820d29d
SSDEEP 192:wR2EPxdKpe2g6sv7bpAPRp2Bc9Q9Hsb+WNnGW4fk2AU0kwawVyIsnAUge:wR2E50s64fUXnqwvL2p0Pe
TLSH
T1DB42D62EA910697B4DDAD269FA253B97D7F6203261D02E84F6FCCD2C18E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 38cc55f242a823440139a5dbccb458cc5fcadf3c018bf6c2b8090c6d99bb0b36
MD5 bbedf8693218ae0c43cb499db9a5e30c
SHA1 5e902a24e80862b7519d7db29d8fbd38da9d6cd5
SHA512 5b952929ee87c1e3384d38b2db0c5c2592f991edb73608d6a82509bfaa42bac64971281a76d877f5edcc991af9e983da748a21d88114ad428747e03b37067352
SSDEEP 192:wR2EPxdKpe2g6tv7bpYPRpWBc9Q9Hsb+WNnGW4fk2GU0kwadVyIsnAUgE:wR2E50s6NfoXHqwvL2v0KE
TLSH
T1A252E62FA810697B5CDAD269FA253B97D7F5203261D02E88E6FCCD2C19E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a93f7c704591b6c85cc35bfd7f9db63a368ddc65b05e770590a3bd917311bfca
MD5 40776e1fc330287c483fe173ad50280f
SHA1 b49f01bc4776b417ea699b58a09a1ba7595bb42b
SHA512 378e29bfa768c8a58f40aa0057c64e798f2c7e138ddb859c5caa7443b33626609cb723a7e9ac46ca6e387fca8bda302f313f165606e4c1d6de6c1fa3aded3de6
SSDEEP 192:wR2EPxdKpe2g6hv7bpAPRp2Bc9Q9Hsb+WNnGW4fk2QU0kwa7VyIsnAUgE:wR2E50s6xfUXnqwvL250mE
TLSH
T1E142E62EA910697B5DDAD269FA213B97D7F1203261D02E84E6FCCD2C19E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 dd2f60b87c921e0c108510918a4feab66d3dbd4c764762bb5eeb58b6c1cf829c
MD5 8e57cb8bfea0622664b34a683f258fe9
SHA1 7ade466af827577f464ccdeb75e934acd9dae0b2
SHA512 cb689c26a4fa66e4985e12ccda8317926a3b0861560065212cef74a011ca18aa9b68950bce8600ecda9aab4c7dc3d35fecf7385e3d9b44d84b7ed25efc483732
SSDEEP 384:tnjp87KxkXqKf/pUZNCgVLH2HfgsljH7pLuLcSjjeXODpk+ErU3hCHGfYT8+wA:tjp87KxkXqKf/pUZNCgVLH2HfgsBH7pl
TLSH
T1EE7219677C4C8E770F94D5CCD8267B4F9DB5024B65E9886883FA982903D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 99f5e595aac523a6dad67e5bbd56772f82df5027c21e60138bbf01f4c77fd714
MD5 244606a84a66caa4027995b1e6615984
SHA1 adbc84b9f8557e228ee3cc606a0c189199c2d702
SHA512 6dc060a126bde752753c5bd555773f3715c41c16e82a2e43a7e821813af1e7820ba6d24d0ee5a6a87554ca3100286a95adcbe6b82b50710be6c43e1acbd6692d
TLSH
T113B0124080015111C00602F411835488F1149F609B0F570143E46D32982916081142A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587f5c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f5c.TMP
Size 96B
SHA256 3055d1afc212db5b30d5b9646e4a309ba032a134e84178f4ac37f9506f886c50
MD5 ed2146967afa743c56e142f119329cdf
SHA1 0334f026f8ab75e3ab267ea3ffd72bd9447771b1
SHA512 2da3cf6aea60d8e4fdd20ea9930f121f1693d3ec594ed05599bb4c9ccf90f91f4182b98f030ff84bd02ddbccca7ccd53223eb184c52f29449cd92c81a3615c6f
TLSH
T1BFB02280C0032202C08303B238C0C2CA3020CF30C20B03028AE00A32CCA03202820220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c0e9a13519a3377c5702dc2a2292bb0a3cc6836c9778d24d97b200538ec3904c
MD5 92409442877de3796a684d669ae5ea7f
SHA1 06e09057a11f32c880045381a59b98ee8ff8c098
SHA512 4c7b43419714da50e8342c87516d781fbcfe7d21c913f35b6a0eaa732d96cd4e9d756e5946f6a7e74fa7c5dfdd921a46462d061f034f2f243486199c870fa149
SSDEEP 3072:qqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:qqfRRVZFX8KZGES4F
TLSH
T14EC312F1A81AD86FF792A30DC38F2F0FF66EB141D2255A8078DD452E94477842363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c556c5561566ce73960f03f2e022f5fe35810ca6630b37b20c770414df0fc11c
MD5 789767d676acabdf29d801f0f00d289f
SHA1 ed7fb75d20124c100119bbcbdb1f508fcb59772b
SHA512 95262d26b3a24e8793717ae1c450a1127ce9d54045dd5735e3a7fb2e2175a650a12c603413a4f3098f54d8ab41c43ab7d875ffd4f07fae69a46b0ff12f66bb9e
SSDEEP 3072:npqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:npqfRRVZFX8KZGES4F
TLSH
T1A4C312F1A81D886FF792730DC38F2F0FF56EB142D12A6A80789D492E94477851363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 43e7615376a5185b9932101f502285ffdd1b309d12b9071645ee864c2939f340
MD5 ad664616af3ab515095415fa54650397
SHA1 45833b9f5b7fd1ec4a258e4e896b576c872187c6
SHA512 cc7f2aa1c54860257cc8eb4169e545adbdc7e2635dffd6789e01fbce7b850e10820dc9fd0b60b8a3588c369f99d51354a864bed79730558bb5696e51dfc999c2
SSDEEP 3072:HqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:HqfRRVZFX8KZGES4F
TLSH
T1C7B312F1A91AC96FF351630DC3CF2F0FF66EB141D1265A80789D452E98477812323B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 92ec28669a7b98a5faa32e88448f8fe872f63dea4a930352adaedf09615b9e46
MD5 1b78c344bd81ca39fd696066b024055f
SHA1 1bc7c7290a379d150a46c630ab61f21b808940f4
SHA512 8896e15f11183f4b4d1e08fa905bd572e67d4cf8e92bdc9d1ebaf7bb46eedffa7bd08bca7116b09dd750351d45d026897e7595ce85b692291a34c18247ae15e6
SSDEEP 3072:TqfRRV6mr9FX8RtWZ/Q+KLl+13pvDOlmHl:TqfRRVZFX8KZGES4F
TLSH
T144C312F1A81AD86FF792A30DC38F2F0FF56EB141D2295A8078DD452E94477842363B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download