hxxp://url1137[.]crypto[.]com/ls/click?upn=u001[.]a3rDJB2v9y9hAhzyhYB5oH-2F9xKf-2FLW1I-2FpzD5ZWxcs7ZsMVn6QbF6rWgQAa6zKualquo_uXBwW983eSO4JQxjq6HEN59BZebALAu1jNaCq9MQujHgKIoFTCsOCOHUIC8j0pl-2B7Oih8DsCHEpKR4UejGpZbvCF-2FQ-2FqSfiK1MGFYHXRxAXdJiysqq585AgQZ5b3oW-2FguD201a5FqKuKOiVC04BtZMgzWYLVDdy4vluCCDmo5wBbS5LHJXVp1C4EwTzaCqy3y2L0wDdXk66qdzoOrXX1-2FaLHkqmhvjsaJ9bt3IH8cj0du3sC1YnRAM0Qr5HfJBFTRvOFF-2FejKwH-2B-2BZStUPhpHubWWQTlvOcYUHsu7i1lJfAku6ZUJve8oTRFN8TZMWpqRxPLy467QSdkXAyCD5H33ChNbqbtXaGKF2a4a4dNNGVGAFEdk1m7xS4fD9S7eu6d9KEixlrSfELeq-2BjOa2gI73pG7ufPUwLTBhp-2BP4k1ax7S9UQ-2F6a5bMqgateM2HvrWsTpxMrybSXCpglyoUJGzy1FfeLfAg1ttTI6hthZKMLNXrCeCBsx0tsjCV4P6X0YTrHavPEXphkIrhHG2T2AmZg-3D-3D

Analysis

max time kernel
150s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/08/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oH-2F9xKf-2FLW1I-2FpzD5ZWxcs7ZsMVn6QbF6rWgQAa6zKualquo_uXBwW983eSO4JQxjq6HEN59BZebALAu1jNaCq9MQujHgKIoFTCsOCOHUIC8j0pl-2B7Oih8DsCHEpKR4UejGpZbvCF-2FQ-2FqSfiK1MGFYHXRxAXdJiysqq585AgQZ5b3oW-2FguD201a5FqKuKOiVC04BtZMgzWYLVDdy4vluCCDmo5wBbS5LHJXVp1C4EwTzaCqy3y2L0wDdXk66qdzoOrXX1-2FaLHkqmhvjsaJ9bt3IH8cj0du3sC1YnRAM0Qr5HfJBFTRvOFF-2FejKwH-2B-2BZStUPhpHubWWQTlvOcYUHsu7i1lJfAku6ZUJve8oTRFN8TZMWpqRxPLy467QSdkXAyCD5H33ChNbqbtXaGKF2a4a4dNNGVGAFEdk1m7xS4fD9S7eu6d9KEixlrSfELeq-2BjOa2gI73pG7ufPUwLTBhp-2BP4k1ax7S9UQ-2F6a5bMqgateM2HvrWsTpxMrybSXCpglyoUJGzy1FfeLfAg1ttTI6hthZKMLNXrCeCBsx0tsjCV4P6X0YTrHavPEXphkIrhHG2T2AmZg-3D-3D
Sample260805-lkgynaha73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1888	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303961825931039"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe
Token: SeShutdownPrivilege	4108	chrome.exe
Token: SeCreatePagefilePrivilege	4108	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe
4108	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4960	4108	chrome.exe	84
PID 4108 wrote to memory of 1888	4108	chrome.exe	85
PID 4108 wrote to memory of 3760	4108	chrome.exe	86
PID 4108 wrote to memory of 3760	4108	chrome.exe	86
PID 4108 wrote to memory of 4824	4108	chrome.exe	87
PID 4108 wrote to memory of 4824	4108	chrome.exe	87
PID 4108 wrote to memory of 4000	4108	chrome.exe	88
PID 4108 wrote to memory of 4000	4108	chrome.exe	88
PID 4108 wrote to memory of 4516	4108	chrome.exe	89
PID 4108 wrote to memory of 4516	4108	chrome.exe	89
PID 4108 wrote to memory of 1112	4108	chrome.exe	90
PID 4108 wrote to memory of 1112	4108	chrome.exe	90
PID 4108 wrote to memory of 2196	4108	chrome.exe	92
PID 4108 wrote to memory of 2196	4108	chrome.exe	92
PID 4108 wrote to memory of 2568	4108	chrome.exe	94
PID 4108 wrote to memory of 2568	4108	chrome.exe	94
PID 4108 wrote to memory of 4004	4108	chrome.exe	97
PID 4108 wrote to memory of 840	4108	chrome.exe	98
PID 4108 wrote to memory of 2644	4108	chrome.exe	99
PID 4108 wrote to memory of 696	4108	chrome.exe	100
PID 4108 wrote to memory of 4892	4108	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url1137.crypto.com/ls/click?upn=u001.a3rDJB2v9y9hAhzyhYB5oH-2F9xKf-2FLW1I-2FpzD5ZWxcs7ZsMVn6QbF6rWgQAa6zKualquo_uXBwW983eSO4JQxjq6HEN59BZebALAu1jNaCq9MQujHgKIoFTCsOCOHUIC8j0pl-2B7Oih8DsCHEpKR4UejGpZbvCF-2FQ-2FqSfiK1MGFYHXRxAXdJiysqq585AgQZ5b3oW-2FguD201a5FqKuKOiVC04BtZMgzWYLVDdy4vluCCDmo5wBbS5LHJXVp1C4EwTzaCqy3y2L0wDdXk66qdzoOrXX1-2FaLHkqmhvjsaJ9bt3IH8cj0du3sC1YnRAM0Qr5HfJBFTRvOFF-2FejKwH-2B-2BZStUPhpHubWWQTlvOcYUHsu7i1lJfAku6ZUJve8oTRFN8TZMWpqRxPLy467QSdkXAyCD5H33ChNbqbtXaGKF2a4a4dNNGVGAFEdk1m7xS4fD9S7eu6d9KEixlrSfELeq-2BjOa2gI73pG7ufPUwLTBhp-2BP4k1ax7S9UQ-2F6a5bMqgateM2HvrWsTpxMrybSXCpglyoUJGzy1FfeLfAg1ttTI6hthZKMLNXrCeCBsx0tsjCV4P6X0YTrHavPEXphkIrhHG2T2AmZg-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe5d26c728,0x7ffe5d26c734,0x7ffe5d26c740
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,10618077438761905436,12077307930151106728,524288 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,17029855052991873153,11143937147636643222,262144 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,2514499203151797338,9141547862201685308,524288 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,8669916633401929195,6354857086144014800,2097152 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,12585984768740736849,7824394099697930426,2097152 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4316,i,17383722642952905047,13708278700467306294,2097152 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,11426185269178501378,2158806505409282553,2097152 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5660,i,6539250584609428563,660488392870352980,2097152 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,626738400012815769,6700681143553883416,524288 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,8151622183684354355,763263652208794062,524288 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,17106343492552321659,6318116201074695453,524288 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,7097201908539188794,5885787577546561309,524288 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5064,i,8024423965519531870,17889041493032550908,262144 --field-trial-handle=2076,i,1093878372028758412,2189827324447813714,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 91f22b0437eba3970480cb5dc537b98956141b9230caf4f7222e25c928875b72
MD5 fc7d296c9e1f665b4ee2140e15b200e8
SHA1 47022ee6eb580e2d1da4efd31de21fa4894b9eee
SHA512 4a8d083a2e28647fc35d9e8d0957fb145c45e565376f3b42b89fc4a1eb8d7352e0a361600d759c294439f8d419c293a7d8a5e6e7214775b18e7a81ea7595e214
TLSH
T1A5E068BACC31EC7719FD0B2A60485B86E75023172B808A5B7A3CA10CCFB073E519686C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 102322d3dad5382a03774790eb2a496d84907064965860924706031f69b7bc55
MD5 0afc9ed638af64112cb496720b1d852b
SHA1 459f14f477c9247c4c7a6d5f1289bcc6359d2b3b
SHA512 cf173d463b26c42c400438a1dc67e6835cfb353dfb1da11deef83a07ad4a7ef36ffc8bbc3b260b8f5ecb59fa4d7b5c72598423f4a90fea239d22df5fe3bd6cd8
TLSH
T1BCE02E1942E0081ADF185BB593F028917578CE1300A60ED360B700F90CA73BC030DD8A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 dbd52fa2d945dc48ccaee23b4d9ab00db7960eb4206267ed06f659e4c660f142
MD5 98a6750fc290bd34fbf1ab7caa3c4a51
SHA1 51fe4d65ff130d643c476c747d3c79a19a45682c
SHA512 deaf4e49282ca4bba482d4946e62cb8db72694f97070c692fff6671f1a3615f4f1d7ff5204ac188300e4d4acecf49b31dd46936a7c376c635b973bb4a48ce400
TLSH
T18FC0123C5A4008D1C7051BFA6BE22787723E8F5371135FD694840068CC237FD610118F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ce026c5c7b482cfb767dbdd3b6382ee670be79b96dac9ba4b048db794dd76d3f
MD5 acff697abd125318e135d1ce62bc1635
SHA1 72bef10f59eaf6bff535a7d993cf74ee49d439db
SHA512 078d0e5c46c0be19d86763f9affaf6cca76b5ef49af54ba409b001bf3ee375327ba4646940cfe1f24da4010af881e1e5c3060fead5ee6f6fd710f96ce26abd1a
SSDEEP 192:D6CkTMVVAaIaEdOvK4m3gg3jLJ50ta5jz0h2K:D6CkTMVVAaIaEdOvK4m3gg3jLJ50ta5a
TLSH
T12ED18CF387E5CA2D8E1156F0A7247E1BCE1D0A24436D3D2688D5BF0B93E2571E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6d75673016f1cddff63b9b54bf0ce320d6881c568666d6ecda6a55bcda2fb7c1
MD5 d2793424f4674895645e8948f61f4ecb
SHA1 effff4ffcf8816b4dbcc81f6d472a1a741ec6677
SHA512 9b05db66799befaf79caa6723567d8644ec9a0eb07a0378faac625ad460131a0f8505c9c19327a7a0552eb9f17f74f01dd50c082da2af87f78d334239bfc4b0e
SSDEEP 192:D6CkTMtaIaEdOvK4m3gg3jLJ50ta5jzXHEw:D6CkTMtaIaEdOvK4m3gg3jLJ50ta5jzH
TLSH
T1AAD18BF387E58A2D8E1156F0A7247E1BCE1D0A24436D3D26C8D5BF0B93E25B1E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 31ad023b739bfb13edaf74a87494c7942fec48c34238ed8b9a6862a24dfaa2b0
MD5 a8c17efc09fbc676fb8c4b4eb73dfc09
SHA1 ed2a7456d325a7dc5f1f9ccd108e9c1e80a3270d
SHA512 4f06df7dc840b1a47cd2f6c44682e4196ba82b07cc169b91348755d9bab7ed90af865fd12cab919c5f37430fa6823f9b094fd9b48c37358ae97ea271810fad71
SSDEEP 192:ERcCdd1PMETv7PpAPRp2XQ9YHsb+WNn+D4fV2S921fheg4VyIsnAUge:ERcCr3rjUXlWwKK2m21fjce
TLSH
T13E42C92EBD14657B5CCBD219F9627B57D3F5203621A42EC0EAFC9A2C15EB5CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4438812d966e1d11c2f4b4dcd5703934145668a842e5f18c309b93e6cd0ba09c
MD5 1386314059085d62a9101bbf1a039b65
SHA1 c0c9d9db0103f0aa592eb50b557e1c7af59924f0
SHA512 f7b9944b5b23df4170a875adebfb1950f8d576c4adda2b26467f584019e888c6a674a0a567adcf681cb9c5f7c120924ecf6d54fd0463d975b4fb31a520df19c2
SSDEEP 384:bxj3K7KxkXqKf/pUZNCgVLH2HfgslcP7pLuLcSjlAXOD3u+ErU3KMHGu/g2kRm:bR3K7KxkXqKf/pUZNCgVLH2HfgsmP7pS
TLSH
T1FF72F967784C9E370F94CACCD8177B4F9DB5015B65E9886483FA581903D8BDE11092FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 609063ff6a8fb7564cca9f88ceba302c249d869d75b5ed21806681575dcb23c1
MD5 f647bd5d535f04b898fef53a208ced56
SHA1 bd03b65301c178f6acb9a7616cdcca44ad655663
SHA512 bcfd4a882546afaf74be6d1b321c6ed735ccbeec37af9d854f9112382b0681197a5def393214504bbca77882bda13d0fd8ae8fd5a08776689b57b0a44f43158e
TLSH
T17CB01240C4415102C41203F4265214A8B128DF11EA0A3B0243E079268C3F1608019050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58722d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58722d.TMP
Size 96B
SHA256 eb43ec22ff2427102c9181a7e92d96736fa1895bcc2b287cfc65faf8a14aa762
MD5 74290736939d388c962f328548d9573f
SHA1 97c6b3fd5f27c9f71ae3c39983c67fdec968cd93
SHA512 c344e8e31d40098ea41f63147586c451c6d2d068f3c5c6ef64ea977b01afb89e80c08c1910d8f9b5beebc34caaca46bf72ac78de62d3881c1653fb00d1c1f33d
TLSH
T12FB00255C1026626C04243F02AD5A9F8B1B8EF2AD703331692F05E66DD2A774563EA60
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7170e91723f1a6db1c2ff54e7c14626ff023ad6a5aeed08e3f296be34453bdbf
MD5 0fff8773be8acf68b66b2a1bec40b370
SHA1 3a1eaef28a362191664ea839f7111f38b766758b
SHA512 fe8c78622787b131b3c38e78496df708304a0dbd46ecbb3334f2f2aa1c1e93b09d8cc456397699d8fa6e5f61145970461371c8297fe0ba6461541c3524f43971
SSDEEP 3072:jq6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:jqdm7Rkm1tYpBeh2BAoa
TLSH
T18DC3123B5D74A83759B9BB5EB08E0A1F1DF14DA6C930DE51C8D86B0823EABCC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 4197da6dc042d4dc38bfd195420a78672e79b631703749e42ac0d9742b54cfcb
MD5 e1e1107e758bc6f3d39a479ea4624e6a
SHA1 ac3da05b9a15118878eabc9119261cf031738d9a
SHA512 48d4a21480cd0c79a45c2ef98b0f405b41971dacebc8c083c1abe7d1e823dc8e03099619608a18cbceb903df06c62e3c9b38116b12dfffac09e7557f6fa5e1ab
SSDEEP 3072:2hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:2wm7Rkm1tYpBeh2BAoa
TLSH
T1EEC3123B5D75E9375978AB4EB08E0B1E1EF14DA6D930DE92C8D86B0437EA7CC0904934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 58da2b9d438b613fc4e4ce8b34d071fe34694b29a6b3f887bc77965484c93c16
MD5 6724947c1940ca40b751bd50bfbb308c
SHA1 6f3ce2d05bb6fcb50ee75c819a92cfd354267884
SHA512 4ca6a97993a3844937fbea93951e15c508d5987ea3f25401d354aef79da7cf356ff99f9f69f0148d5cdbcc42b2fa4d8b18378cfef77993b910c15250430f2d9f
SSDEEP 3072:Oq6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:Oqdm7Rkm1tYpBeh2BAoa
TLSH
T18BC3123B5D74A83759B9BB5EB08E0A1F1DF14DA6D920DE51C8D86B0823EABCC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 171KB
SHA256 019d5de874a5e5eebae5aa4a8e255b6f40887575c50a3ed964fabcf052649d6a
MD5 83a8d6028ad0a3f61cfbd5f62312d1bb
SHA1 444eb73b46cacef89948d186b5aae71ec42249c8
SHA512 3afb4539ce5b98a4e65fc3ad305186e2427eadbff4b2073258fa051e7d55e22e556b6b5d0b13f8d07a6cbab6636792bbf3d690c91df2e4a94312e43dad642d8c
SSDEEP 3072:jrWvtCsW9rCL7+n5nlekAcsGGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:jS1C3rCOHrBsxm7Rkm1tYpBeh2BAoa
TLSH
T15D0412765C78E57E6D38EE6B248F26070EB04DABC818FFA285D46E0023F798C4945938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download