hxxp://links[.]discussions[.]tripleseat[.]com/ls/click?upn=u001[.]xIO7TBwc3WE-2FXC2fMf5ONzFqX2GQTWDy-2F6TNUQYJ1ze9JLXlxp-2F44onloQ-2Bm8Ev7QHD9PI-2FdiQFrTIet8kfuBIu7xYrTOIzJZnEweCy7WDmcet1F-2F-2BMrL9i-2BuLudphEhdn4BGeFIud6KsMeZbCjGAq5N-2Fxb19V1mG-2B3jQZK-2BHaA-3Dg3s5_KH9Wtvy62WLVN4xaxncUiee0Eqc-2Btshzo7a5yEph2aD-2FYSFT27vkoo7sWlhJkhGFElCWyIO-2BdDFAcrANB1tAqOvY76XYr9bhz0UnD0IlQwjUajgguwxVEOjXnN-2FNiLyrCg5Tn4-2Fym7FIDIKlntRQN1Y5Yd7tmdJZt9XSnjeQutM-2B38yAjAPIsRZsSMNtgkLUEHS43VSRdkABM-2F09HCD7e4EdBd-2FO0R9yJ56zZwXR12-2FieuoXK6kc1a81NMQaEBaP8Un2HIvMW7-2FAP-2FTj1mBjsyh5iMCx5Rnb6Ld4JRXO0ngBeoYZVV9VIkVXuWB4sGC42l0JMdQ6lc7RBjld0pgWEpV2F69w8yDh0YioJeXv1stxV4a0T0GGP0ySJQpfuSEykpH5IOv-2F2q5Nduepy4G6XtMDbtxaGq2QLYhzkHZq40pGjsjhUr9FqDDvoD-2Ft2H-2Fz50hP5H0NfiqRMwNhhHkamwhr9FwxGHyPKt6K1iF3G-2B3RK07zfyBivMy04MXLKQpLouEMq3-2BlrXBjXhDSimoxH8NCuzXCXvBJO3i4TIvsLmcHRdnx3w0W5aWiLOaketQfbT-2B1bhLxhVz0x46yKNWnHoVAwK8Y7JSVbXhcGuM3DXBm-2FghdrFdSjeyNl-2BqKJh56rJaJqa2pDJROmbpXLQetaAiwLXTrRJ1Tk0rIg5hfGNw-3D

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://links.discussions.tripleseat.com/ls/click?upn=u001.xIO7TBwc3WE-2FXC2fMf5ONzFqX2GQTWDy-2F6TNUQYJ1ze9JLXlxp-2F44onloQ-2Bm8Ev7QHD9PI-2FdiQFrTIet8kfuBIu7xYrTOIzJZnEweCy7WDmcet1F-2F-2BMrL9i-2BuLudphEhdn4BGeFIud6KsMeZbCjGAq5N-2Fxb19V1mG-2B3jQZK-2BHaA-3Dg3s5_KH9Wtvy62WLVN4xaxncUiee0Eqc-2Btshzo7a5yEph2aD-2FYSFT27vkoo7sWlhJkhGFElCWyIO-2BdDFAcrANB1tAqOvY76XYr9bhz0UnD0IlQwjUajgguwxVEOjXnN-2FNiLyrCg5Tn4-2Fym7FIDIKlntRQN1Y5Yd7tmdJZt9XSnjeQutM-2B38yAjAPIsRZsSMNtgkLUEHS43VSRdkABM-2F09HCD7e4EdBd-2FO0R9yJ56zZwXR12-2FieuoXK6kc1a81NMQaEBaP8Un2HIvMW7-2FAP-2FTj1mBjsyh5iMCx5Rnb6Ld4JRXO0ngBeoYZVV9VIkVXuWB4sGC42l0JMdQ6lc7RBjld0pgWEpV2F69w8yDh0YioJeXv1stxV4a0T0GGP0ySJQpfuSEykpH5IOv-2F2q5Nduepy4G6XtMDbtxaGq2QLYhzkHZq40pGjsjhUr9FqDDvoD-2Ft2H-2Fz50hP5H0NfiqRMwNhhHkamwhr9FwxGHyPKt6K1iF3G-2B3RK07zfyBivMy04MXLKQpLouEMq3-2BlrXBjXhDSimoxH8NCuzXCXvBJO3i4TIvsLmcHRdnx3w0W5aWiLOaketQfbT-2B1bhLxhVz0x46yKNWnHoVAwK8Y7JSVbXhcGuM3DXBm-2FghdrFdSjeyNl-2BqKJh56rJaJqa2pDJROmbpXLQetaAiwLXTrRJ1Tk0rIg5hfGNw-3D
Sample260519-nw88dsfs2n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3484	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237002951683288"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3720	1784	chrome.exe	87
PID 1784 wrote to memory of 2880	1784	chrome.exe	88
PID 1784 wrote to memory of 2880	1784	chrome.exe	88
PID 1784 wrote to memory of 3484	1784	chrome.exe	89
PID 1784 wrote to memory of 2612	1784	chrome.exe	90
PID 1784 wrote to memory of 2612	1784	chrome.exe	90
PID 1784 wrote to memory of 1100	1784	chrome.exe	92
PID 1784 wrote to memory of 368	1784	chrome.exe	93
PID 1784 wrote to memory of 1100	1784	chrome.exe	92
PID 1784 wrote to memory of 368	1784	chrome.exe	93
PID 1784 wrote to memory of 3056	1784	chrome.exe	94
PID 1784 wrote to memory of 3056	1784	chrome.exe	94
PID 1784 wrote to memory of 4804	1784	chrome.exe	98
PID 1784 wrote to memory of 4804	1784	chrome.exe	98
PID 1784 wrote to memory of 5096	1784	chrome.exe	99
PID 1784 wrote to memory of 4960	1784	chrome.exe	107
PID 1784 wrote to memory of 1788	1784	chrome.exe	108
PID 1784 wrote to memory of 1144	1784	chrome.exe	109
PID 1784 wrote to memory of 3680	1784	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links.discussions.tripleseat.com/ls/click?upn=u001.xIO7TBwc3WE-2FXC2fMf5ONzFqX2GQTWDy-2F6TNUQYJ1ze9JLXlxp-2F44onloQ-2Bm8Ev7QHD9PI-2FdiQFrTIet8kfuBIu7xYrTOIzJZnEweCy7WDmcet1F-2F-2BMrL9i-2BuLudphEhdn4BGeFIud6KsMeZbCjGAq5N-2Fxb19V1mG-2B3jQZK-2BHaA-3Dg3s5_KH9Wtvy62WLVN4xaxncUiee0Eqc-2Btshzo7a5yEph2aD-2FYSFT27vkoo7sWlhJkhGFElCWyIO-2BdDFAcrANB1tAqOvY76XYr9bhz0UnD0IlQwjUajgguwxVEOjXnN-2FNiLyrCg5Tn4-2Fym7FIDIKlntRQN1Y5Yd7tmdJZt9XSnjeQutM-2B38yAjAPIsRZsSMNtgkLUEHS43VSRdkABM-2F09HCD7e4EdBd-2FO0R9yJ56zZwXR12-2FieuoXK6kc1a81NMQaEBaP8Un2HIvMW7-2FAP-2FTj1mBjsyh5iMCx5Rnb6Ld4JRXO0ngBeoYZVV9VIkVXuWB4sGC42l0JMdQ6lc7RBjld0pgWEpV2F69w8yDh0YioJeXv1stxV4a0T0GGP0ySJQpfuSEykpH5IOv-2F2q5Nduepy4G6XtMDbtxaGq2QLYhzkHZq40pGjsjhUr9FqDDvoD-2Ft2H-2Fz50hP5H0NfiqRMwNhhHkamwhr9FwxGHyPKt6K1iF3G-2B3RK07zfyBivMy04MXLKQpLouEMq3-2BlrXBjXhDSimoxH8NCuzXCXvBJO3i4TIvsLmcHRdnx3w0W5aWiLOaketQfbT-2B1bhLxhVz0x46yKNWnHoVAwK8Y7JSVbXhcGuM3DXBm-2FghdrFdSjeyNl-2BqKJh56rJaJqa2pDJROmbpXLQetaAiwLXTrRJ1Tk0rIg5hfGNw-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff65d5c728,0x7fff65d5c734,0x7fff65d5c740
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,6057852113294781570,13661839585338454681,262144 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,450153597057371528,6128049830514693693,524288 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,9158366513571635906,11416658951676286966,524288 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,1517987236787868804,7477228971249672250,2097152 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,18216100940273279677,10149660061638087879,2097152 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4176,i,6478886771410103002,6030509971498180076,2097152 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4460 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,17651549338252876498,1256233884506663465,2097152 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,185629589610852427,15338502425641634012,524288 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,9362194129955176626,5291724177760525631,524288 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,3402247105383288259,17088005724775827466,524288 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,10872629926915485494,12384891226051853028,524288 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4468,i,13966055802707771428,1496129905700585758,262144 --field-trial-handle=1880,i,1943465794676098611,553748651073515912,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 79a18e01beb5e7ec4b42c7a9b22e5916b979f3c4a6d25ae74c946e076a68551f
MD5 2dbcdee97c0b15f1cc68f8fe901a384e
SHA1 6d9bf32ccdcc883ff566fca3769cce69ecb1a9fa
SHA512 922a0c40948e4346d5a55d47761fb88b438e8afa11d3b1b9f005ce8910097e090bf7cd94b01ac15e201975c13c77fe13d1f85965724a8638d390b357932a5fed
TLSH
T1D9E02BABD921EC375CFD4B2D50940B4AEB20536727A0895F7A3C81088FB16770586C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 fb41a38710be485fa26b08389afd4d8462865daee1b37b0fd156fd378a9b677b
MD5 350bb4e3096e978e879afa14f4029cd7
SHA1 16c2a6f92567ff71020e27b8154abfa67573abb4
SHA512 df39d5829af86af6560c4473bedf9055bb4156d86cf640daa4b86d34b9c8d12a83a2af002e1af2df7460d318a200cccd3b640dc1da6174c917e8a46db5d34e7b
TLSH
T1B7B0122800D83A01CB8202312AE326403418CF3A2105077B41C07084EC3FFF24060052
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6e596a2c4d503a8a733e1ae7e7aaa36bfea7ae53b23b801c3194963a960e528f
MD5 fc6772d880ca63343c353faaec71629c
SHA1 27c9ab7bacaa0323eb2a149b9c3af82fdf2251f1
SHA512 bd4120b853895df1c98dfebc6ecafd2c5fed4b4476394b74dbb33909f53caa80baea9b9b262f2799a88515e1bc1552555d9a4f9aca9f51a0d57d8af2861f6fcb
TLSH
T1986190F3C3E8867D890151F4BB152E2FCD690A24536C3D57C8D4AF1B57E28B6E24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 73a0aa502ce2991f60ad43ab5f87f78ebc558f600866f79096a06b36ec4c9eed
MD5 8625d7771a8bb8bc3c1a7257878cc458
SHA1 3a88e54f5f05815b505c005a860918f95ca48d3a
SHA512 3718bbceb344904a622691d9b980c9868d0456b5bd67fce9a9c983ecb7f077348636cf2d8a626c895678d88db5fa45d51997e4f9b561f1165442ef644151d061
TLSH
T1426190F7C3E8867D890151F4BB152E2FCD690A24536C3D57C8D4AF1B57E28B2E24068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f5b8532e77153b11e3a8efe6e8514df4164da3e32290d3f023d3d9a140406905
MD5 557c5191e3c1b5238ced119d448f761d
SHA1 d6db2445f7a11218982b1407661e8a7abf93411a
SHA512 73faf62b257516a5faea1c29b14cb5000a07b8846560308759ddff389f1abdd9f4b6ae07b4c6a3ba6b25f210fd72409536b3e9e986539697bbe02386efb0cf14
SSDEEP 192:IRnDDuaqq9ic48kLmCohpv7ApAPRp2JR9qHYlb+WNnno++2w2k+peqU+VyIsnAUp:IRnDDuaqsKKCohpkUX2ksnJk2kyU2e
TLSH
T13B42962EEE24693B9CDBD269FA257763E7F5103521D42E80EAFC892C14D75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 debf281a64962f20baaf15948a4f9d8a3d313985cbcfd7c34cfc6cb9b31d586e
MD5 de7a34a16440ec445fd315e048a3d5fc
SHA1 de0ac3dbbe85f95e1938bbacc81a481a67334f6e
SHA512 8ad0aa13e3cbdff737661d6236a1499be26f0cefcba73cb542d8abb4bde8d9430f7be2b818c34d1957f6c908646bb442da279d697d77efaa83fd3d2562ffa0ae
TLSH
T1A7B0120184016191C0C312F0124314CCB2145F11F60A170283E06933C829165841A050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589507.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589507.TMP
Size 96B
SHA256 be1037fd1ab224dc6c3e58c4d4204f1ba55a58602fe748913449d013b520405a
MD5 8de952b542e9908fe4603efc7dff20fd
SHA1 41e38b4922f5e497bc311234e381e58388161610
SHA512 27704b8e8d103a81970dcda7ae7e7aeb8605fd2a77778f3c9ea26ebee0fbd15b5d9b568828bf19a170df2f4b5628288348f749120e35fe785abdec41b47b2ba4
TLSH
T1F0B002F5D1426212C09313B03ADA95FCF1A0DF65D703A63292F01A6ADC2AB7945A6562
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 87a9d4400c458bcf0d1efbd5c966412dd9fb36581a608cb5b3220f5f485e8989
MD5 476bdc7b48d156750ab9e7c8b0b8b5d5
SHA1 959600916394cfc70c9fca96a0b79290422958d0
SHA512 64957145ed7fa4ecbfe94599c65d4a671386fc4d67f6be61c369755f89b302af4bda2c123c8b8110a926d228c24d0076c09e3bd563aa2f8ee77ec1025eac1596
SSDEEP 3072:uIGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:0m7Rkm1tYpBeh2BAog
TLSH
T180C3023B5D75A8375CB5BB4EB04E0A1F2EF249A7C920DE92C8D85B0423F97CD1A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5f484fb17b7111560b23c7b902194b42790151a970ee0f539b0297413ee1343d
MD5 206ee401bbc2e2061cb2aba88ebf2158
SHA1 cf749bf817b1772050d7fc74dd5e0d4910152f19
SHA512 3d005ff636349bcf3e6861f11ddfd216b16b23aedb178e44f081a94d899c7568137a9538adf98058fba180a6365ebf5fa0126e932d96b2a1d074c3936c5a0c18
SSDEEP 3072:ujGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:tm7Rkm1tYpBeh2BAog
TLSH
T111C3123B5DB4A8375CB5A75EB04E0B1F1EF249A7C924DE92C8D85B0423E97CD0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9129034e5f0b391198f1f8cab6ff4cf32cd08b4683220a24d660b72546cca5a1
MD5 4d706cff32089c014dc56a59f8746294
SHA1 ef4d63945c8a484fe573b0ab5e415abed4fa11e7
SHA512 d93a180266e241e6eec7cd1accfdc3109f028c9a405dd5cb722b8e352105f8f2f72e7f094e3e0758a4b52f6253f432c105ddde38bb73df70222b6ae549598895
SSDEEP 3072:vjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Cm7Rkm1tYpBeh2BAog
TLSH
T1BFC3123B5DB4A8375DB5A75EB08E0B1F1EF249A7C920DE92C8D85B0423E97CD0A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 fdffbdb79bb4416ee363a8d1f8ee04478d4efe90660d9195693fbcfb15e6a4f7
MD5 b5dfa83c3ca5b799ee456b6734284715
SHA1 28324aab17e5a68d568996e5ec553c38a554605a
SHA512 8332d84902e6d3e246af49368f108d4d4846a6caf6d03cc8c1f323cc1f26d4fc1096608df27823b0b86e0814f07634b2bdaf5789a472d6fbaef9b559e7f011e6
SSDEEP 3072:vbGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:6m7Rkm1tYpBeh2BAog
TLSH
T1C2C3122B5D74EC3B5CB5A74EB44E0F1E2EF149A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download