hxxps://inbox[.]rippling[.]com/api/mailings/click/PMRGSZBCHIYTEOJUG4ZTSNBUFQRHK4TMEI5CE2DUORYHGORPF53XO5ZOOJUXA4DMNFXGOLTDN5WT6YLNOASTGQTVORWV62LEHUYTSZBZGIZWEYZNHBQWENZNGQ2GINJNHBSGGMZNHE2TKYZTME2TEMRYMNRVY5JQGAZDMYLNOASTGQTVORWV63LFMRUXK3J5MVWWC2LMLR2TAMBSGZYV63LBNFWGS3THL43VIVLWPJUGIRTYJJSVC3ZZKFRHG22VNN3U2MSHKNVFCRZRIRIXKZSHNNNECPKSOBLDO43BPI2UC5RXLBTDG2TDPJLVQ42ZINFVIYTKOV4DS4CKPF5GK3ZSNJTWMQTPIYZHG4DHPJNEKNRZGZSHMQSMMZOHKMBQGI3HE5DMNFSD2MBQGNKWIMBQGAYDAY2EG5AUKSKBGARCYITPOJTSEORCGBRTMOBUMUYDELJXGFTDELJUMYZGILJYMQ3TSLLDGVQTMOJXMQ2DCNJWGQRCYITWMVZHG2LPNYRDUIRUEIWCE43JM4RDUISQN55GCVLJKRRWQ32VMJVTM3SXFU4WCUL2OBMEUSKIHBBEQX3FI4YGGQ3PNNVVG6RZG5TT2IT5?q_mailing_7TUvzhdFxJeQo9QbskUkwM2GSjQG1DQufGkZA=RpUXTWNyWe8PemVxXC26y19rymNQpcgFuwChfYmvDUiwiDfG2QUYMBZND

Analysis

user interaction
yes
max time kernel
659s
max time network
658s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://inbox.rippling.com/api/mailings/click/PMRGSZBCHIYTEOJUG4ZTSNBUFQRHK4TMEI5CE2DUORYHGORPF53XO5ZOOJUXA4DMNFXGOLTDN5WT6YLNOASTGQTVORWV62LEHUYTSZBZGIZWEYZNHBQWENZNGQ2GINJNHBSGGMZNHE2TKYZTME2TEMRYMNRVY5JQGAZDMYLNOASTGQTVORWV63LFMRUXK3J5MVWWC2LMLR2TAMBSGZYV63LBNFWGS3THL43VIVLWPJUGIRTYJJSVC3ZZKFRHG22VNN3U2MSHKNVFCRZRIRIXKZSHNNNECPKSOBLDO43BPI2UC5RXLBTDG2TDPJLVQ42ZINFVIYTKOV4DS4CKPF5GK3ZSNJTWMQTPIYZHG4DHPJNEKNRZGZSHMQSMMZOHKMBQGI3HE5DMNFSD2MBQGNKWIMBQGAYDAY2EG5AUKSKBGARCYITPOJTSEORCGBRTMOBUMUYDELJXGFTDELJUMYZGILJYMQ3TSLLDGVQTMOJXMQ2DCNJWGQRCYITWMVZHG2LPNYRDUIRUEIWCE43JM4RDUISQN55GCVLJKRRWQ32VMJVTM3SXFU4WCUL2OBMEUSKIHBBEQX3FI4YGGQ3PNNVVG6RZG5TT2IT5?q_mailing_7TUvzhdFxJeQo9QbskUkwM2GSjQG1DQufGkZA=RpUXTWNyWe8PemVxXC26y19rymNQpcgFuwChfYmvDUiwiDfG2QUYMBZND
Sample260720-qagblaa13k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2632	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290262955037477"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
1516	chrome.exe
1516	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4952	2580	chrome.exe	85
PID 2580 wrote to memory of 4484	2580	chrome.exe	86
PID 2580 wrote to memory of 4484	2580	chrome.exe	86
PID 2580 wrote to memory of 2632	2580	chrome.exe	87
PID 2580 wrote to memory of 3228	2580	chrome.exe	88
PID 2580 wrote to memory of 3228	2580	chrome.exe	88
PID 2580 wrote to memory of 1980	2580	chrome.exe	89
PID 2580 wrote to memory of 4364	2580	chrome.exe	90
PID 2580 wrote to memory of 1980	2580	chrome.exe	89
PID 2580 wrote to memory of 4364	2580	chrome.exe	90
PID 2580 wrote to memory of 2940	2580	chrome.exe	92
PID 2580 wrote to memory of 2940	2580	chrome.exe	92
PID 2580 wrote to memory of 2436	2580	chrome.exe	105
PID 2580 wrote to memory of 4736	2580	chrome.exe	106
PID 2580 wrote to memory of 4240	2580	chrome.exe	107
PID 2580 wrote to memory of 3232	2580	chrome.exe	114
PID 2580 wrote to memory of 1516	2580	chrome.exe	118
PID 2580 wrote to memory of 1900	2580	chrome.exe	123
PID 2580 wrote to memory of 1900	2580	chrome.exe	123

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://inbox.rippling.com/api/mailings/click/PMRGSZBCHIYTEOJUG4ZTSNBUFQRHK4TMEI5CE2DUORYHGORPF53XO5ZOOJUXA4DMNFXGOLTDN5WT6YLNOASTGQTVORWV62LEHUYTSZBZGIZWEYZNHBQWENZNGQ2GINJNHBSGGMZNHE2TKYZTME2TEMRYMNRVY5JQGAZDMYLNOASTGQTVORWV63LFMRUXK3J5MVWWC2LMLR2TAMBSGZYV63LBNFWGS3THL43VIVLWPJUGIRTYJJSVC3ZZKFRHG22VNN3U2MSHKNVFCRZRIRIXKZSHNNNECPKSOBLDO43BPI2UC5RXLBTDG2TDPJLVQ42ZINFVIYTKOV4DS4CKPF5GK3ZSNJTWMQTPIYZHG4DHPJNEKNRZGZSHMQSMMZOHKMBQGI3HE5DMNFSD2MBQGNKWIMBQGAYDAY2EG5AUKSKBGARCYITPOJTSEORCGBRTMOBUMUYDELJXGFTDELJUMYZGILJYMQ3TSLLDGVQTMOJXMQ2DCNJWGQRCYITWMVZHG2LPNYRDUIRUEIWCE43JM4RDUISQN55GCVLJKRRWQ32VMJVTM3SXFU4WCUL2OBMEUSKIHBBEQX3FI4YGGQ3PNNVVG6RZG5TT2IT5?q_mailing_7TUvzhdFxJeQo9QbskUkwM2GSjQG1DQufGkZA=RpUXTWNyWe8PemVxXC26y19rymNQpcgFuwChfYmvDUiwiDfG2QUYMBZND
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5cafc728,0x7ffb5cafc734,0x7ffb5cafc740
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,8716169841099321405,17877929617985566843,262144 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,7236833638300807081,3649594101143696205,524288 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,10935957689509230886,15411080778372478287,524288 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3160,i,586292305937186513,779878150615255866,2097152 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,13014532517678979475,17860104008081899565,2097152 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4384,i,5884370879128173264,8447221680366011009,2097152 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5116,i,15697073231817503772,14701184629546287371,524288 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,10872751433022072265,7118986842762981354,524288 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,3627885323170419816,13349415936395020568,524288 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,4508410344397732075,10496788743758848100,524288 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4880,i,8210323447334916500,12819952788013284200,262144 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,3416145725146274090,6867524612639867502,524288 --field-trial-handle=1984,i,13430434316329814025,6920357952270468570,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ac2a395861342dbc83c679ce8837d0aeb7afacec1d8ad45974d17b9cac7bbc8f
MD5 ca52fc4295926967a10925de0ff65164
SHA1 8819c278ce5ba8cd1a5030c82cec94b28263c5c0
SHA512 dafccb190c0967555332733362e9b9e2711290c3f45f0e6e140c5e8e0dc2834c681b4cd8e9804e49458531e8e751cd883b46c8d91733349e78272452714706a6
TLSH
T1E7E02B69C975DC3714FD0758A0502746E755139B2A419D4F7B3CC50C8FB563B8685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 056f05192370df308f33505992ef80065a52e31b596fea29791f5652de941933
MD5 e8d66277e275e26134b666b369464253
SHA1 db37a5f9f7fd7b4e8c03c1c13dbf95c8d5a22405
SHA512 1d2cc97875d58832c399dc6e480faf4dc24ad92c6c90dfbeb28b5827e22c99f101988dbac11ac9d72193aa1458070ec80ee24cd0173a1250ec6ae261714b294f
TLSH
T1D821627412FC6512CFF45D34F8A1AA6035A14C65C2823BFBA7763136645FFC58802146
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4c9b4ee32c083b2992f7395d0d2acaeec284e1b16290ca3ea98279def1a3bf23
MD5 efd296045f6a1caaeead48a82013012b
SHA1 fa450cae0222c69932c4532648f7ba5172e585bb
SHA512 a1d1bc4b531f95662219747d74bb454ab636eda2feebc5b1f0a03af7b532ea0f0b79de9873cd58a6ca19d8db041631f2869822dac1a4c9f40487c295f51669b3
TLSH
T12A4146F3C7EC896D890196F8AB192E1FCE790E14536C3C5788E4AE1B53E2871D25158E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b9c12c406d1b00cfa3b1049e3150df3eb5029ebf962bd89abbb31d7259cad062
MD5 4e53e9eeed5fd8b9dd5352a000984310
SHA1 46a43e775e8509d44f9c997cf855ad33d4327d7d
SHA512 6cb8681abbe34f71f72659f610ea33829a8dc4020475d64b5c0cee2e9066374b3ef458eab306ab9ba70b30d546510cab7e1a5504f712a444a0c9264744d249e3
SSDEEP 48:YALlRVwRVYh+aXYfo7EdKsQNRAR8KXsFPFR0RaR3csURmgRCZRsRTsSgmgRlRTRP:D4QsaIaEd+N6WlaI6z+KRirtmvfjjhq
TLSH
T1729190F787B4A53DCD2191F8AA165E1FCE6D0920531C38AE85E16E2753E38B1E140B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 50d3ac8cb2a7e883d072928110767542a80d008a24e2db5a15c7b9a81ecde66b
MD5 a5396d5c75287bc0d5c0f0fee92dd706
SHA1 ef17ee77dd8083aa0f75efab9637aea3ef3c546f
SHA512 c2e5a67c243c6fbe3e124fc5981c0b666b51e473a227a855bc46da789c4b59e8228c0dd9057746b88fc7552d39f2f8b15ef8064655bb3961cdd1ba08c91e69f1
TLSH
T170817DF747B4A53DCD2191F8AA165E1FCE6D0920571C38AE89E16E2753E38B1E100B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 1813d00bf82c1f1b38155e30550566418411a6db79f581b77b25753b6d92b47c
MD5 8bd2fd9958d4bd1d77f703f2fe7c3822
SHA1 6b858c0541c63c9c990be0a32d6ee5972c31904b
SHA512 afb159e6269e2b578eaea9c82b956e636c5ca607a12b7a802ab9a7fa1816530e7e76286e4f6daacef8565256849ed4f00b7d872a6246ba175eac5e5d5bab9c4f
SSDEEP 48:YALlRVHRV3hZaXYfo7EdKsQNRAR8KXsFPFR0RaR3csURmgRCZRHs9RTsSgmzs5dt:DffnaIaEd+N6WlaI6z+WRUrtmVK
TLSH
T112918DF787F4A53DCD2191F8AA166E1FCE6D0924531C38AE89E56E1753E38B1E100B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1e8d8766554ded390fbd7f55ca82b83b87c2c7935c66f21189a745bc890bbcbe
MD5 d3cd25343e7c17ff90e7374d0c0efa51
SHA1 dcf9a92255d1a7032ab517664a8d23e5de6c45aa
SHA512 eb0dc5c8379de626cde97834691d551d73a41f195f83df642c68d3c50c8a7a297db848a7de161aea4197d3ca547414833f61398c1c625d6954b05adee553c72a
TLSH
T1C0819FF747B4A53DCD2191F8AA166E1FCE5D0920531C38AE85E56E1753E38B1E100B4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1013B
SHA256 4a960d810bc0d926adc5d90ba933f712672be63246c452ebb1448341beb8719d
MD5 8b4d3b302e79033da4568f0a4ba62fce
SHA1 2391104df3c72694913faaf1c7e8df3abe999f63
SHA512 372aa0465c3ab7e3ed056cd9a802a620ab86a942a1ad5f11792698ef557c92cdeea83e71323d114b31b208b07b9be81d5cbb7ede9c8c8e2db684df2656f0a142
TLSH
T155117F67D26EB4AB107949771D097C0A79BAA4310243B4F0CB5A923EE0C99F71716857
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8c3eb43b1955bedcfe6c55761062a029f3963ac556fc2a3b96baa612b5fb46e1
MD5 ff3ef09dbd2b4cdf1f03ef43cb932ba1
SHA1 f2d7ea50c6ace29bc79f069b61e7b130b2e26e2a
SHA512 cc1f0bd13706333828b1805004256c340e57c69b33f34f3c3776272c8090e5499d510d7519f2babfd99aa36a760c06fe32c94218e0e660fb04a587d183e88d8a
SSDEEP 192:IRUJA3nFrFpVqqAv70pAPRp2dDn9+Hsb+WNnFHozTA2XFP43tVyIsnAUge:IRUJCnf+qcgUX48wpog2Vse
TLSH
T1EA42B62EAA506D7BACDFD269FD617713D7F2212161911E80E6FC8A1C19EB5CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 91f6149ea99fe9349353bb14afcccf6a921c5f0884e0ab2d6f435b71c98446fd
MD5 5649c3493e6d5c87d6bde22568bd9509
SHA1 c1b10eb0f7bf9f91d0e4b439e972427b08a434f2
SHA512 50d649b2d1540336e3c370289ce3c3ac075a32fca5696772797b84a7a27d7ec1239a81fb07a492d53f4e2a2782d8d394ba83b61762013f19738e8d0c08778854
SSDEEP 192:IRUJG3nFrFpVqtv70pZPRpAdDn9+Hsb+WNnFHozTA26FP43/VyIsnAUgE:IRUJ8nf+NgbXS8wpog22oE
TLSH
T17B52B52EAA506D7BACDED259FD517B13D7F2202221911E84E6FC8E1C19EB5CD322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ef1bdda4dfc36652cd33b0e7d1362e74f354a08729210da76039bd7a2fbc3777
MD5 5b6b27337637bca0e637580fc6de26fd
SHA1 d584d3c23c082b1f7082076e1649f4d672f20c35
SHA512 f417fc84e87a632a1d001127cff1793684fd51763e8a483e18e24b260b2e648e47110a82fc2cd93e320a5ee1aef95ede749252fa2a962da4d2782434973c7e53
SSDEEP 192:IRUJ/OGVqUv70pAPRp2dDn9+Hsb+WNnFHozTA2bFP436VyIsnAUge:IRUJ0QgUX48wpog2Ble
TLSH
T1AF42D82EAA106D7B9CDFC269FD617763D7F6202125911E84E6FC8A1C19E79CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6896c4fbc7d823e324c14a0c8f8acc9259679fe8f26c51e0cbce02914bc8b008
MD5 9f65d21dbcf6bdc752aed76339bedef2
SHA1 6e49d9806b64123a52a6c4ce6f8c7ddbbfea42b3
SHA512 691d39d3cddd5f5739035d2c4be9f1604eba593382f5da2ba3d6b6b46a4319db9975829163133be45b54195cafd115c0164ec385f544703d6c0c9b87fc349e19
TLSH
T12DB01241C0019101C01302F42243148C7154AF20970A6B0143F47A23CC259608114050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590565.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590565.TMP
Size 96B
SHA256 a407068b5faeaefabc5993da9e204630055d592bbcb4dbc8e7c071e457ae3923
MD5 8dd35175f3b4ab2a9bd6d9967855a25e
SHA1 dfcc72864a723f3ac845886490b1f77a1780df3d
SHA512 1866090636c164dbc80e462a135f982d39e9c1a89d7ec5fa08c31cb8a328d80b29823c4020d4717a7e948d77c8b3a7bd1cd673d8ae81a2dfa3e803ce014795ae
TLSH
T1F7B0025DC102625AC04343B06EA5B5F87162DF35C613125B92F03F6AEE6766045665B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 de5292b2e3bf43751003a7ad3ee6dbf7ae29df16494baf3024b4bf7acfc27a46
MD5 d8540209aea0c185f5f8a74850eb5aee
SHA1 1608027cec43b8d64edb16c2388e010896cf5969
SHA512 fbea667618688226131a74d07ddcee93b225ca99eb2d5d232c969581cf75e19814762d77c7b4f887edd60f8bd55d15b07e306393d7f9a7828d1ac07ba3218afa
SSDEEP 1536:8AgbyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:Alqfd7NtZL8cHQRZEQ6Sps3
TLSH
T14AC30237EBC21F339ED2DB64B5130E9757F644AAD034D301EE6D3BAB6883591A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3a485489cef0cb749f3c19f81f978ba3bc96514e262103b0fed06d4fd7370b6f
MD5 f6599cece44c7d6268aa25135c753a76
SHA1 68ca6b95687cf5616ef65b539005f8bbee72ce01
SHA512 7944f85d8f9bf9d385b16667b5875d27d9bbeb2cf22a8911d97fc3b1963f7d89a63164ad574b3d4ec545ab1ac65d186d09bcc72845227672406a39000d01197d
SSDEEP 1536:8AvMyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:P2qfd7NtZL8cHQRZEQ6Sps3
TLSH
T1F0C30237EBC21F339ED2DB64B5130E9657F644AAD034D301EE6D3BAB6883591A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 88ec959e6df879629e753b0b09bcac6ffdf2b7f3978928f1b7c0d61a7f58b16f
MD5 d9b5b8d5fa06352ea3b133ad7700358f
SHA1 39cb5a8f5c437895f8be0c809e993d89742c66d5
SHA512 94fe3b673d1193712bc633805434d1096e1a52144966ca6dcae5f52de141b391d76bfc07331cf6d8be5baa15a103926f1beb5fd0a792d90cc9e89f7a4a2817df
SSDEEP 1536:8AethyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICo:+Nqfd7NtZL8cHQRZEQ6Sps3
TLSH
T186C30237EBC21F339E93CB6479130FD757B544A99034D301ABAD3BEB688399165424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 66bc0c93e0acd0db5f2433e022a6fe7f07033348190a8c3db5234d6f376f9d91
MD5 91d92d5208e96c6596bb4c776c792ba7
SHA1 364883d74a03ae3fd3046cc4a8ed4a8ae49ae2b3
SHA512 4b5ffe72d4ca3fcae07f0be914991fc3326b0ce08fc9f8e580fbfb6c5a6172ae48a890524c446d3d4f18b272583bc9acb86516a460b32c18a0d7331ac35630e4
SSDEEP 1536:8AVyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:7qfd7NtZL8cHQRZEQ6Sps3
TLSH
T137C30237EBC21F339E93CB64B9130ED757B644A99034D301ABAD37EB6883995648249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 814a67713c8dc92c5c446ad997eb3e5e6212a361699624e282df6c9facbad030
MD5 1b43bb60f81c540f761d7a02400c2d73
SHA1 941adf3ac865f011abae0fd7d8809aafb9229acd
SHA512 93499eaa8e15e994160bc659358124fc672ef8735b69513d023f03b8839c55682ba2d14dd0fe280945fe0596b356df0b18ba5910ca41af62036bdb667be0b89b
SSDEEP 1536:UAvMyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:H2qfd7NtZL8cHQRZEQ6Sps3
TLSH
T11FC30237EBC21F339ED2DB64B5130E9757F604AAD034C301EE6D3BAB6883591A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 203c3858c8706e1270f9739945501b6a85ab84f96e720e8024066a189146788e
MD5 76a4ce229c0e10a3f941e9101dde8c2e
SHA1 961a04f4b4aa294c98911e3578e283f50cd465b3
SHA512 2fe999d2722d1bc27f1f200cb6d24b94eaafa9d2609486f86deb8f6650c38afe0aead837b9fb155d186eaf52b96ab2a9486401e62d3a0a6d03e6ae2eb5d0f687
SSDEEP 1536:buLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:iqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1B1C30237EBC21F339E96CF64B9130FD667B644A99030D301AAAD37EB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6c9307583e06351759533dd0cb25acc5ea64f66d871fe95fa15203a2e317e56f
MD5 f686a6f6c74053be55d3b3ad6f458da0
SHA1 e60091e7bf7191672b46d7864d2d9d88ce47d703
SHA512 e3d0e605362049550f82ecb636febf4673df423add8989cd4ecd5f8a3dd97e5da013ce558131608273f11e54e8019ad0b7dd89f5ac47dbc41eaa5179fc801f1d
SSDEEP 1536:BAethyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICo:BNqfd7NtZL8cHQRZEQ6Sps3
TLSH
T13BC30237EBC21F339E93CB6479130FD757B644A99034D301ABAD3BEB688399165424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download