hxxps://crowc[.]pro

Analysis

user interaction
yes
max time kernel
899s
max time network
878s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/10/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://crowc.pro
Sample261015-warefsaw6x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
960	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4752	chrome.exe
4752	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe
Token: SeShutdownPrivilege	4016	chrome.exe
Token: SeCreatePagefilePrivilege	4016	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe
4016	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4532	4016	chrome.exe	81
PID 4016 wrote to memory of 1812	4016	chrome.exe	82
PID 4016 wrote to memory of 1812	4016	chrome.exe	82
PID 4016 wrote to memory of 960	4016	chrome.exe	83
PID 4016 wrote to memory of 3892	4016	chrome.exe	84
PID 4016 wrote to memory of 3892	4016	chrome.exe	84
PID 4016 wrote to memory of 6132	4016	chrome.exe	85
PID 4016 wrote to memory of 6132	4016	chrome.exe	85
PID 4016 wrote to memory of 5548	4016	chrome.exe	86
PID 4016 wrote to memory of 5548	4016	chrome.exe	86
PID 4016 wrote to memory of 4552	4016	chrome.exe	89
PID 4016 wrote to memory of 4552	4016	chrome.exe	89
PID 4016 wrote to memory of 892	4016	chrome.exe	90
PID 4016 wrote to memory of 892	4016	chrome.exe	90
PID 4016 wrote to memory of 5900	4016	chrome.exe	92
PID 4016 wrote to memory of 5900	4016	chrome.exe	92
PID 4016 wrote to memory of 648	4016	chrome.exe	93
PID 4016 wrote to memory of 5652	4016	chrome.exe	95
PID 4016 wrote to memory of 5652	4016	chrome.exe	95
PID 4016 wrote to memory of 5240	4016	chrome.exe	96
PID 4016 wrote to memory of 5240	4016	chrome.exe	96
PID 4016 wrote to memory of 5256	4016	chrome.exe	97
PID 4016 wrote to memory of 1820	4016	chrome.exe	98
PID 4016 wrote to memory of 5224	4016	chrome.exe	99
PID 4016 wrote to memory of 32	4016	chrome.exe	100
PID 4016 wrote to memory of 32	4016	chrome.exe	100
PID 4016 wrote to memory of 3928	4016	chrome.exe	101
PID 4016 wrote to memory of 5264	4016	chrome.exe	102
PID 4016 wrote to memory of 5264	4016	chrome.exe	102
PID 4016 wrote to memory of 4752	4016	chrome.exe	103
PID 4016 wrote to memory of 4724	4016	chrome.exe	104
PID 4016 wrote to memory of 4724	4016	chrome.exe	104
PID 4016 wrote to memory of 5724	4016	chrome.exe	105
PID 4016 wrote to memory of 5724	4016	chrome.exe	105

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://crowc.pro
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b3c3c728,0x7ff8b3c3c734,0x7ff8b3c3c740
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,11351255295983861690,13876195046804891492,262144 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1436,i,5564407033420085171,12775257770397471439,524288 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,3906920280256029238,10999057588542239535,524288 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2772 /prefetch:13
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,14162252275339720724,7266041049230344232,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,3208801439831473761,8527297073635612123,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,6396401608180072653,16924804499288391462,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4412 /prefetch:9
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,12149313767312185335,6649879324832016683,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4964,i,2660462803411856876,7643701089700961535,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,16973812289300913907,11598276401306644258,524288 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5540,i,2490158144590010392,7894260981572134653,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5004,i,3490527522390617621,6677006270842378574,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,12850544850778070504,2630248552209480478,524288 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,11783813297217120302,351698742911201629,524288 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,2732369725894084316,11905782273854900029,524288 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4416,i,10803641603610260185,7008368448875251451,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:32
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4932,i,9067106792501903027,5729917566995123146,524288 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4484 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=744,i,9876413432319919876,11331811282348429571,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4132,i,4826409192299531042,2471528032700457733,262144 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5652 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4624,i,9993993233307762584,14213867283895202314,524288 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3212 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5580,i,1755767025660003645,13822261913711991720,2097152 --field-trial-handle=1948,i,5485106900193699338,16445401749033628611,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5724

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7277e0e1-8952-4514-a6bb-a7d85820293a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7277e0e1-8952-4514-a6bb-a7d85820293a.tmp
Size 132KB
SHA256 f238ea44d80aa2e346166b1a971109c6d1a07e34aac6a998c962561f111dd27f
MD5 1ac058b5453e7c48ecdd3e66350cb8d4
SHA1 3f3da3105d3bcca3cda86df4f990cd93c07f3ca0
SHA512 e91e822ade61a911cd3d56940dfc7ce0d7483e5c2202c4666cb72740f1a1e6bb8bcd221ca7365626c8cfc2c65ebf92fbfeefce530ba5414862e176d16466a2f5
SSDEEP 3072:sWwT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:sWXThDxWhaj5mjie/JYFobx
TLSH
T176D312239CAE05FB19BCC508506D3F0086F985B39640FF679AE87A4F50C7EE8A357166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f977df4-024e-4294-8003-4e71fd721020.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8f977df4-024e-4294-8003-4e71fd721020.tmp
Size 132KB
SHA256 fa9c96170ce0e8df4f263be1de70374c2a3cf09aa52feffeff3644246b0472d2
MD5 d9149a05ab198ad1c864f69d4506ab47
SHA1 cf1153e4111647dbc421bd116cd0c364278dc935
SHA512 730aefa30caf1be67ec31246ea7e1812642d73f84f8146a1f9c8f9cb30530a5b43b22d55cecc08f2e6e7089e072465ef46f01b81aa2af6038dbc23be9479a923
SSDEEP 3072:gWwT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:gWXThDxWhaj5mjie/JYFobx
TLSH
T1D8D312239CEE05FB19BCC508506D3F0086F985B39640FF67AAE86A4F50C7EE4A357166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00842392-168f-417b-99db-a4ca305873bc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\00842392-168f-417b-99db-a4ca305873bc.tmp
Size 12KB
SHA256 42968df4c0788f9cf5cf134c6467ab8519c1f552acef836fa4296e1660fcf4ca
MD5 6d389d0eec6fce7044a662e0f39e595c
SHA1 a6e3f16c189823093c4f3feec5de1c04d243692f
SHA512 1248c2214f8ace078b5e446855f7961d8570335001059cec4634744cf6560367e96c8427becb2a206e58695a2d6218e1fbc0f15f33aa410f328a2577b7975774
SSDEEP 192:qRTkgfLB/wLdRA9pT9L8nkMaZPv79fGpAPRp2jgl49+Hsb+WNnx1vx/2CHKLsYVi:qRTbzBRfHNGUXyowPZ2MUe
TLSH
T16A42C62DBD10797B9CEBC22AFD667B67D6F6102220D42E84E6FC892C14EB5CD2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

219ac132-ae53-4c4f-ae69-52ed666593ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\219ac132-ae53-4c4f-ae69-52ed666593ca.tmp
Size 12KB
SHA256 380a9e1ed4618e1e8b0b93cfaff5d96815f6ed8efb2df42269b224a35d1598a1
MD5 3e7ec303b7ed7dbad31692717a3ceb04
SHA1 7d090206b4d28608e704309c551c0415cd67ff25
SHA512 60293ce653ac47e6d88b15fa72464dbac8afbf3e402b6c36cd17b91d806bf70139e7ff7744170d59b357a9babc4c4a488034d20be447a4908515cba99beb246d
SSDEEP 192:qRTkgfLB/wLdRA9pT9L8nkMaZ4v79fGpAPRp2jgl49+Hsb+WNnx1vx/2dHKLs4Vo:qRTbzBRfkNGUXyowPZ2p0E
TLSH
T11D42C62DBD00797B9CEBD22AFD667B67D6F6102220C42E84E6FC892C15EB5CD2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62ab4b47-1ca2-415d-988a-ce36a03cc15c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\62ab4b47-1ca2-415d-988a-ce36a03cc15c.tmp
Size 17KB
SHA256 52faa1c0a2c145f24cb6bf0e4a48b0237ba969495c82d742d374c6759b4dc290
MD5 10219fe671f251c5a102a95887dac447
SHA1 7f90b76134fd16f85ae158bfb5c71425e83ed0ae
SHA512 caee2e22a50a8965d0fb94b1a22f1071e58b061efd33cb3d9eeb5e5a6d58e48d84366477559486942f9c5103a8a77cad8186aef0b09c97ec8427f2be08e3f9cc
SSDEEP 384:SEjml7KxkXqKf/pUZNCgVLH2HfgsluN7pLuLceSMtXODml+ErU3I6HGCX2v41q:SIml7KxkXqKf/pUZNCgVLH2HfgsAN7pe
TLSH
T18A720A677C4C9E7B4FA4CA8DD8277E4FACB5024B55D9886442FA5C2603D4ACF11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7076e747-f048-485c-b00e-504eb18ca965.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7076e747-f048-485c-b00e-504eb18ca965.tmp
Size 13KB
SHA256 2eb041a571a06cb947f6f4e6dcf624aaef65f77993c12dbcd62af9f29b0ba3d4
MD5 8cb82a681796b310ce71096070f36749
SHA1 6961757355ddad0dbceb92719834d210963365e8
SHA512 9d2835064bfee784cf9fe0a5a8420d5bd031f7aeea4ad0b23566935f9870225146db7b9c6ec67b6ea353e662bb88e63205da06dc5a897367133487c8529cc90f
SSDEEP 192:qRTkgCLB/wLdRA9pT9L8nkMaZ4v79fGpcPRpijgl49+Hsb+WNnx1vx/2AHKLs+Vo:qRTbmBRfkNGMXWowPZ2OeE
TLSH
T1DC52C72DBD10797B9CEBD22AF9667B67D7F5102220902E84E6FC8A2C15EB5CD2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c283ca5-1744-4d4f-a5e6-406bebeac187.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8c283ca5-1744-4d4f-a5e6-406bebeac187.tmp
Size 414B
SHA256 af2ae048ed0024edb27aa5f1841bc4232ad623fa595bb2e5378f86c47788154a
MD5 dec92a52340f1e493bdecb3933ceb4a8
SHA1 f960518486823b45a280d878966dda479207d0d4
SHA512 123518d7f984e8c9a9cdc7c989ae16af021505bb0f6e765b2843ccdfcaa05ddf0be0b88a0fb579c24ce497c2906622320ec048ae2fb09bddd7c4041e78a26662
TLSH
T113E055A6C820AC7B08FD073820A00385D668031B2640880B363C42084FB0A3B418680D
MD5 SHA1 SHA512 TLSH

Submit Download

565312a2-ab7d-45f8-ab8b-21a0d969a2c7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\565312a2-ab7d-45f8-ab8b-21a0d969a2c7.tmp
Size 523B
SHA256 7253b3bfe8f32ab010dfaa6b2165480860bad25a7775a180c28f37efc193db74
MD5 54f4d874ddbd277b46be8db7260d679b
SHA1 211cdfa418f4fe91aea8a0df96d351755b1a1cb8
SHA512 41fb401026b52b1932ebe441c4cd668742db9312f48e08831990a99f9ae6044b371e29547202fb43669ac4a22641b3f5cb53c93ee6285c76bb6914fb9508d8f2
TLSH
T1B6F02B67E6B9B82740BF446F1E04F80E66B9643101506CE4CE5A422DA0988B70F23443
MD5 SHA1 SHA512 TLSH

Submit Download

619beaea-cd0c-4aa7-89de-1c9d5c14322a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\619beaea-cd0c-4aa7-89de-1c9d5c14322a.tmp
Size 1KB
SHA256 d833858cb49cb5b58bef016f0dd25ba24e58d1158a6585ccb0b7f1c2a35e8595
MD5 0fef82d78892bccde8c0112d3ce049a8
SHA1 728d62d6dd3cc07593614a76213eac51a2607fbd
SHA512 605a80f72d07694e5bdf68f4f628b434180591f2860842d64f1387e293c443c8effa1da61cbc2f8aaa5a7a40096f58d9bf2038fbb404907d54163a16f5f72c23
TLSH
T19E41ACF797B4857E8A1192E4EA156E2FCE7D0524031C3CA688D4AE1B43F2972D14078E
MD5 SHA1 SHA512 TLSH

Submit Download

692230d0-129e-4a77-be9c-a286876d91ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\692230d0-129e-4a77-be9c-a286876d91ce.tmp
Size 2KB
SHA256 f494952b81e6e331ba56b63549a2f9b448791eb8fc1bb09a35f7988c06851e64
MD5 37939fcc1ce31b08e1a5c16fd1b7be72
SHA1 dee24d0e6933bafef1c41b51f0e3999a09ade3f3
SHA512 00b5791477667b694df6850b87afe0c598b438b447ba900c34ef4be9e0cd13833519514865fa608e99a634753166e6659d29c5a5cea5eb1e0070f3dc290aacbd
TLSH
T1EB41ADF787F4857D8A1196E4EB156E2FCE7D0524032C7CA688D46E1B93E2972D14078F
MD5 SHA1 SHA512 TLSH

Submit Download

71d1bc78-6ec3-4960-ae00-69e1e1409554.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\71d1bc78-6ec3-4960-ae00-69e1e1409554.tmp
Size 2KB
SHA256 f5814e03f94ce6a696bc9a0cce1f268409b4a850046ab62adec79a12a96296c6
MD5 23ebf673a20e6bb3754d6797745b5a6a
SHA1 16ed32cf74815a2a0cea8fa7afb9d4d36ae00961
SHA512 0b68f24be97d94009b0fdeb0ae719e68a1087dd4a328f76ab66afdca6634844906bc25dc94035d32f126abd2799722b9e97ca8e1e0774078ec52489255de119d
TLSH
T11F419EF787B4857D8A1196F4EB156E2FCE790524032C7CA688D46E2B93E2972D14078E
MD5 SHA1 SHA512 TLSH

Submit Download

74859aff-a424-45e8-a2e8-351995730b81.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\74859aff-a424-45e8-a2e8-351995730b81.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 1c12d3f6079fb941262587ce904966e82653b6ceb590de5693ecd3763197821d
MD5 06df61637a1afb7a91b96f666390d7a4
SHA1 d6a9d76a72afa3f00d4beff19fcb8fbedee364a8
SHA512 1cbe14d8b7226c8489542e244b9ecb2ca7bd1aa6c778265032266b19e9d88720f5064b22a13cf13170de08f3a37ee1282d564472f72aacee0dea34e5c97a808d
TLSH
T10EB0125880C15381C05603F411A014DC7158EF14EB06234153F00D018C391A0D05B096
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 7068749f7a2f0e6cb627fcab813dfbb414f8efbd4de2c41b7b80b93f0799c516
MD5 ce0a2a81755d7044ff69fcac4a748b10
SHA1 ebda4a52c12ddd01204a201648b9bbe587bbfc73
SHA512 465e24693e266df49cf2ddc0c5f186259532b7e459a6b5317af568be3ce083b68cc794722bcd2247e4724679ce4e0e38161172a67d5bd40c83e32835855cfa9f
TLSH
T14EB02200C0022382C00203F02A8088CCB2A0CF28C2030A03C3F30A22CCA2220CA22820
MD5 SHA1 SHA512 TLSH

Submit Download

e8f44060-9d67-4ec0-8bae-ce6e70e2c887.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e8f44060-9d67-4ec0-8bae-ce6e70e2c887.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b63d227c-5c6f-4348-9ea9-75774a460a28.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b63d227c-5c6f-4348-9ea9-75774a460a28.tmp
Size 131KB
SHA256 899afcedba0b864c5692db1c5dbde13809258d934025afc99c58617adc21ed1c
MD5 b14d8cd958c48303de94e04e5e93c6e9
SHA1 85ee737f0282b50c37b22d5de0757d74d0ceb3ec
SHA512 1060dc9d4c54f1252e6431f5e07798b945112003a4edcac111d1dd5ed61a4a56d404831d75b7a0a9289dda2a222f1f2cd0c33270397f92dca207aae9ef7f9538
SSDEEP 3072:JXT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:JwThDxWhaj5mjie/JYFobx
TLSH
T168D312239CEE01FB15BCC508507D3F0086F985B39640FFA39ADC6A4FA0D7EA4A366155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f948d78f-0571-4a45-8804-01374e6ab2f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f948d78f-0571-4a45-8804-01374e6ab2f1.tmp
Size 132KB
SHA256 3784f9e5bd20c8ae17df4f0b91ebd58a19f0c5110ea79bb4caf6f7a5682ab106
MD5 49bcacc555aa3e23ba85c0fb1950a0f0
SHA1 b2f0d7a21c4a6b25b06d1cf6eb8fac437b6da57e
SHA512 2bea8751c62460de2164bd11d575e330c7f110fedcc0c88a6d6b289645e3a86965971d428bae6f0c8a41d81cdb1bbb8f2cb79bdab8fcb98ba35996b8c0efd323
SSDEEP 3072:gscT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:gsrThDxWhaj5mjie/JYFobx
TLSH
T1DCD31223ACEE41FB15BCC508907D3F0086F985B39640FFA39AE86A4F51C7EA4A35B155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb938da1-ebf3-4d3b-a203-fb90276b64c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fb938da1-ebf3-4d3b-a203-fb90276b64c8.tmp
Size 132KB
SHA256 1fe083e8e212bba2f6fa4778d3e4a768e87ac6507315167ef6c3b9badd8dbbfb
MD5 c32e8a8cfc7871ddb123970b43da1a43
SHA1 834d76d4b6ab9fa9060ec823089748b6e39f79fd
SHA512 f9a46d35f9b7a66b3a388da450c5b4a9f2db80503b3fa1ba04838346713ac88b3cf6e3dfc2d3023dc3c5e251d2b0665f64626a962f2d3f5891430b3281363fb3
SSDEEP 3072:NscT8ThDUxx0Rghaj57THH/53w/7qclnYe/JYNfobTOLXE:NsrThDxWhaj5mjie/JYFobx
TLSH
T1C8D31223ACEE41FB15BCC508907D3F0086F985B39640FFA39AE86A4F51C7EA4A35B155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download