hxxps://links[.]notification[.]intuit[.]com/wf/open?upn=u001[.]7LcC2OkeCD1yjJDoa9bh90VR1AYiY9W-2BhsX07jQt8tJJMkYznjhvapBZfUGG8OUeX2-2Fap8bXkWTF2KYNjSHZrJpUHUFnJJhdR7D54S29EISXeY8dzGIm72KCkD8vlQnJK3Ml0b7lYrfq7cYvtjgrOR-2BmfvHF0gEEtytv-2FJZu0g8YVld0kSlVrqOG2iTGPaYSYc2gpyZpPnRuK4ou4XqBGhgB7UrPV-2FZzDZTx0-2Fyt2cI1oe35d-2BBs3dUkWdIgfuOORNogfE2yW9NczP68B19OH04Ug45Elolrt-2FnrHZxYhvLxw-2F2tNJquClKPdfuE8kLIXi7cSo-2F73x-2BQpHJgyNZuY-2FFvhWOEdujZ-2BGYygTHXN7vPwb5y1XPsmz4zASnQxvFlOL4NJjK8UyK3RO-2B2aDZ5ewNJrNw5vrq2bPwQeLsxkmBFVN6LHB0zfCzVDoTU1o6vhnovPPl754CQakg7NIW7ZBglvNg5xETd0CP1z-2FzkYBxxTitQRESipC6i4scWBzpcNwPgzPNS06VRJQxIPnADgzzJGvMthZClCT0a2HYyUD-2FRt4JnnloOGWka7ZI8UKT9t9LoO98V1g6d-2FfMJPRlTCrgKrzwQjgg3KtW96Ih3SosVbp354E5QTr7aAP7rAe2u3kBgIng6ZgZU-2FLmznFERiynDgeaRtrZz2lTnZLBAqRr8M0OWZg7Hs7QHAXRNkW5lpJq-2FKVRFY09R2WxGN-2FARHYXgOWrd7ibnRvc7Mbrh6w5tEdW0ycF3kJgas8-2F5dCbKlwpDdn8-2Bdx0g8uKYtSIVXFZ0WL6pkCYfWbMV95eAUCy5WBFVZrJ-2FgYnDMnXdnkwU-2BgYYc3QUGVN7XgzruBbcsqHv4j50nvSbqmqqFJN-2BNlUAsc4A56LtEm0ydZ79G-2B7sY-2Fp20Y2AXfU1WN7MGVqyjI7u5eq04UxY90ACA-2BMNsZtOapv-2BIEfkmKG-2Brg-2F5WlvdKvCQhlv50-2F6LArDCm1JQpGiAV2LboxKmzNWgso7ZuUpRuUXaDzf3grrT1hEd4XgNiuMwpth0VqPOiAoUIAF6wyeGD6UPQcUxJ-2BtnXzjx18JLmPXuukXtFFM626QneaD-2BNJ3vZjeuHChZe-2FYfUHoUcCct17Wsa34ngbpNvy335qUSm72cG5tL0tOIhvKkKGc1wt-2FPvFriy-2FTeCRP12QjyH7EZHwNx-2B-2Bnm2bEJ1wCPJ2pddsY7-2FnnKQ9fwD9MwWd06styklAFXutM0eajHePCGAVIiYNxru9LcIzale4-2B4SkXhSw8ukwQDgau6vmxKNNpicvx43IKUZy-2FOUHHvD3tl3fOl3xY4dEJCAhgzlRDYlVZoKk4oZLExG5O3KX9N3ybf

Analysis

user interaction
yes
max time kernel
76s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://links.notification.intuit.com/wf/open?upn=u001.7LcC2OkeCD1yjJDoa9bh90VR1AYiY9W-2BhsX07jQt8tJJMkYznjhvapBZfUGG8OUeX2-2Fap8bXkWTF2KYNjSHZrJpUHUFnJJhdR7D54S29EISXeY8dzGIm72KCkD8vlQnJK3Ml0b7lYrfq7cYvtjgrOR-2BmfvHF0gEEtytv-2FJZu0g8YVld0kSlVrqOG2iTGPaYSYc2gpyZpPnRuK4ou4XqBGhgB7UrPV-2FZzDZTx0-2Fyt2cI1oe35d-2BBs3dUkWdIgfuOORNogfE2yW9NczP68B19OH04Ug45Elolrt-2FnrHZxYhvLxw-2F2tNJquClKPdfuE8kLIXi7cSo-2F73x-2BQpHJgyNZuY-2FFvhWOEdujZ-2BGYygTHXN7vPwb5y1XPsmz4zASnQxvFlOL4NJjK8UyK3RO-2B2aDZ5ewNJrNw5vrq2bPwQeLsxkmBFVN6LHB0zfCzVDoTU1o6vhnovPPl754CQakg7NIW7ZBglvNg5xETd0CP1z-2FzkYBxxTitQRESipC6i4scWBzpcNwPgzPNS06VRJQxIPnADgzzJGvMthZClCT0a2HYyUD-2FRt4JnnloOGWka7ZI8UKT9t9LoO98V1g6d-2FfMJPRlTCrgKrzwQjgg3KtW96Ih3SosVbp354E5QTr7aAP7rAe2u3kBgIng6ZgZU-2FLmznFERiynDgeaRtrZz2lTnZLBAqRr8M0OWZg7Hs7QHAXRNkW5lpJq-2FKVRFY09R2WxGN-2FARHYXgOWrd7ibnRvc7Mbrh6w5tEdW0ycF3kJgas8-2F5dCbKlwpDdn8-2Bdx0g8uKYtSIVXFZ0WL6pkCYfWbMV95eAUCy5WBFVZrJ-2FgYnDMnXdnkwU-2BgYYc3QUGVN7XgzruBbcsqHv4j50nvSbqmqqFJN-2BNlUAsc4A56LtEm0ydZ79G-2B7sY-2Fp20Y2AXfU1WN7MGVqyjI7u5eq04UxY90ACA-2BMNsZtOapv-2BIEfkmKG-2Brg-2F5WlvdKvCQhlv50-2F6LArDCm1JQpGiAV2LboxKmzNWgso7ZuUpRuUXaDzf3grrT1hEd4XgNiuMwpth0VqPOiAoUIAF6wyeGD6UPQcUxJ-2BtnXzjx18JLmPXuukXtFFM626QneaD-2BNJ3vZjeuHChZe-2FYfUHoUcCct17Wsa34ngbpNvy335qUSm72cG5tL0tOIhvKkKGc1wt-2FPvFriy-2FTeCRP12QjyH7EZHwNx-2B-2Bnm2bEJ1wCPJ2pddsY7-2FnnKQ9fwD9MwWd06styklAFXutM0eajHePCGAVIiYNxru9LcIzale4-2B4SkXhSw8ukwQDgau6vmxKNNpicvx43IKUZy-2FOUHHvD3tl3fOl3xY4dEJCAhgzlRDYlVZoKk4oZLExG5O3KX9N3ybf
Sample260808-jm698abq2s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1716	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306489043716555"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3164	chrome.exe
3164	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe
Token: SeShutdownPrivilege	3164	chrome.exe
Token: SeCreatePagefilePrivilege	3164	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe
3164	chrome.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4252	3164	chrome.exe	87
PID 3164 wrote to memory of 1500	3164	chrome.exe	88
PID 3164 wrote to memory of 1500	3164	chrome.exe	88
PID 3164 wrote to memory of 1716	3164	chrome.exe	89
PID 3164 wrote to memory of 4352	3164	chrome.exe	90
PID 3164 wrote to memory of 4352	3164	chrome.exe	90
PID 3164 wrote to memory of 4520	3164	chrome.exe	92
PID 3164 wrote to memory of 4936	3164	chrome.exe	93
PID 3164 wrote to memory of 4520	3164	chrome.exe	92
PID 3164 wrote to memory of 4936	3164	chrome.exe	93
PID 3164 wrote to memory of 4980	3164	chrome.exe	96
PID 3164 wrote to memory of 5096	3164	chrome.exe	100
PID 3164 wrote to memory of 3144	3164	chrome.exe	101
PID 3164 wrote to memory of 2620	3164	chrome.exe	102

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://links.notification.intuit.com/wf/open?upn=u001.7LcC2OkeCD1yjJDoa9bh90VR1AYiY9W-2BhsX07jQt8tJJMkYznjhvapBZfUGG8OUeX2-2Fap8bXkWTF2KYNjSHZrJpUHUFnJJhdR7D54S29EISXeY8dzGIm72KCkD8vlQnJK3Ml0b7lYrfq7cYvtjgrOR-2BmfvHF0gEEtytv-2FJZu0g8YVld0kSlVrqOG2iTGPaYSYc2gpyZpPnRuK4ou4XqBGhgB7UrPV-2FZzDZTx0-2Fyt2cI1oe35d-2BBs3dUkWdIgfuOORNogfE2yW9NczP68B19OH04Ug45Elolrt-2FnrHZxYhvLxw-2F2tNJquClKPdfuE8kLIXi7cSo-2F73x-2BQpHJgyNZuY-2FFvhWOEdujZ-2BGYygTHXN7vPwb5y1XPsmz4zASnQxvFlOL4NJjK8UyK3RO-2B2aDZ5ewNJrNw5vrq2bPwQeLsxkmBFVN6LHB0zfCzVDoTU1o6vhnovPPl754CQakg7NIW7ZBglvNg5xETd0CP1z-2FzkYBxxTitQRESipC6i4scWBzpcNwPgzPNS06VRJQxIPnADgzzJGvMthZClCT0a2HYyUD-2FRt4JnnloOGWka7ZI8UKT9t9LoO98V1g6d-2FfMJPRlTCrgKrzwQjgg3KtW96Ih3SosVbp354E5QTr7aAP7rAe2u3kBgIng6ZgZU-2FLmznFERiynDgeaRtrZz2lTnZLBAqRr8M0OWZg7Hs7QHAXRNkW5lpJq-2FKVRFY09R2WxGN-2FARHYXgOWrd7ibnRvc7Mbrh6w5tEdW0ycF3kJgas8-2F5dCbKlwpDdn8-2Bdx0g8uKYtSIVXFZ0WL6pkCYfWbMV95eAUCy5WBFVZrJ-2FgYnDMnXdnkwU-2BgYYc3QUGVN7XgzruBbcsqHv4j50nvSbqmqqFJN-2BNlUAsc4A56LtEm0ydZ79G-2B7sY-2Fp20Y2AXfU1WN7MGVqyjI7u5eq04UxY90ACA-2BMNsZtOapv-2BIEfkmKG-2Brg-2F5WlvdKvCQhlv50-2F6LArDCm1JQpGiAV2LboxKmzNWgso7ZuUpRuUXaDzf3grrT1hEd4XgNiuMwpth0VqPOiAoUIAF6wyeGD6UPQcUxJ-2BtnXzjx18JLmPXuukXtFFM626QneaD-2BNJ3vZjeuHChZe-2FYfUHoUcCct17Wsa34ngbpNvy335qUSm72cG5tL0tOIhvKkKGc1wt-2FPvFriy-2FTeCRP12QjyH7EZHwNx-2B-2Bnm2bEJ1wCPJ2pddsY7-2FnnKQ9fwD9MwWd06styklAFXutM0eajHePCGAVIiYNxru9LcIzale4-2B4SkXhSw8ukwQDgau6vmxKNNpicvx43IKUZy-2FOUHHvD3tl3fOl3xY4dEJCAhgzlRDYlVZoKk4oZLExG5O3KX9N3ybf
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe171fc728,0x7ffe171fc734,0x7ffe171fc740
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,18399992704277401954,12116024529213737600,262144 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,3154677345474271583,9057378955755437546,524288 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,15506415923335366524,2969615179929505435,524288 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,1406599778662752865,12152824436003381351,2097152 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,9234210026405896679,11985409156333684769,2097152 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5140,i,3660769891172353387,3642690648120050186,524288 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,14629329151469849621,5647360570730955295,524288 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,12720072729921451181,16540539309839237313,524288 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,13960437555833181770,5069161517643502383,524288 --field-trial-handle=1988,i,17691725757723228489,2976028019365882877,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a14160c1b55c6b3c36c65bc24bff236a821acad5d6242077d06613ac88aac60f
MD5 2619146bb781bb92c55ffa7b754a5c82
SHA1 ba2791797019c3472c3238ad1545c1cd2c899542
SHA512 1c5709074c92d19db2e6c86730edd68cd8b9d918d2fa3a82458e5074f18086a17abaab5ce5db106d876cff47ea4f4db19b123265b0678d55552fdc849f3ad69e
TLSH
T124E0E5AAD925AC6B19F9172C50905F4AD64013572F408A4B3A3C8109CFB4A760146C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c7deb11b38d1590bb05be747a7c91dcd54bdd2ffd73a55ad60078b90ba884dc4
MD5 c9e5fcbb2064afa6f40f544fe1c3b758
SHA1 843c7daeb292e6a487bdcb13ef159429d95ae529
SHA512 fb5c8a0c28060151e81b7ec356acdd416a6915e78b28335bd199e91e35d0f32caeeb6f95c81f6732e7faf4fbbe19d5bd670ab95466fdeb2dfe6cb38193b5994c
TLSH
T19631AAF793B4857E8A1192E4EA11AF1FCE7D0524031C387289D46E2B83F2972E10179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 916959b11fc474d407ed92bc2de43d3502d11be0b1cb55ec50290043c46b1d84
MD5 5512c3b5b1e0c85b6941a103f9140490
SHA1 230209378eda25ba56237908ce3a50e491af9999
SHA512 17c591be47e83ed4102dd2676e0071d12bde4be33b7c57ddcd99810e1fac5811374fec4c45c6528309631065cda73650dad5b14e8364f7a1a594a9c9857f5cd8
SSDEEP 192:/Rscgxyx7v78phPRp5st9DHsb+WNndJkB+2rKbwoekmcnVyIsnAUgE:/RrgCD4bXa5wTn2YwatE
TLSH
T14342B62AAD14293B6CDBD219F9667B53D3F6103261D11F94EAFC892C15EB9CC322350B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2b70828c162a0daaa2594bc0caf3531ba0b42d1494549acd586910a871416a92
MD5 dca33b93b2030524310b7dcf0689c070
SHA1 3924de67937018f26d49ac29f1a4109eb98a89dd
SHA512 9edc113fa6998d708bc44c0bf8eba6cf32fa998bc5dc63ce4e4281663fc7f69a89a1263dec44a1a7735f24fd5f68e2955e55e3373c63f55fef1a99891f67fc6f
SSDEEP 192:/Rscgxyxhv78pAPRp2st9DHsb+WNndJkB+22bwoekmc0VyIsnAUge:/RrgCx4UXt5wTn2gwase
TLSH
T19942952AAE14293B6CDBD219FD667B53D3F6103261D51E90EAFC892C15DB9CC322740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3b250cccba854a7aff0d5a043e8be082adcfbf8d467ca197a6e0dc847ebb70c4
MD5 02d6f91f4114c8f6290eceb8b2378326
SHA1 f924493ab982669898264a15cbaf868cad8d09c6
SHA512 5396e5b1c201858b5535213008f890a1e7086ac368a5a62c8ab2ef5be32708b1c4345bc50c4d02e93ad4125ec61496596cf4a8ca68af6c04d80567c55949b6e6
SSDEEP 192:/Rscgxyx7v78pAPRp2st9DHsb+WNndJkB+27tbwoekmcjVyIsnAUgE:/RrgCD4UXt5wTn2BwaBE
TLSH
T19B42A52EAE14293B6CDBD219F9667B53D3F2103261D51E90EAFC892C15DB9CC322750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 d42a48a380bb6a21d6afe8f1c487ca38a84c62546ee982bf275ac87dde76ee76
MD5 43073b332983f730da43fbb6a9a922a7
SHA1 97812bc1c8ca93356ec380cb381c9bdc852c91ed
SHA512 91ab9d97742cd5cf62376ad44ecf4e303df54ae929f932f4cd897e17b82f75fe6e81d37045819a484f706e9b0d327d098faa52f651a510b25c23ff4623122c65
SSDEEP 3072:h1Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:hcm7Rkm1tYpBeh2BAoO
TLSH
T117C3123B9C65A8775DA9BB0EB04E0B1F1DF24967C930DE46C8D86A0433FA6CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 30e85d5f40da04ae1b4c865995547115d013cbac72ca3a504d1124c6beb93725
MD5 a18b45fd58de4f1f6c729deb76a1e80e
SHA1 b4b69c9dc204dd589c8d43a79b23872eddbdfdf6
SHA512 df0f0b507a1e8ef1c6cf50e3c57411046c4743ba47e6cbf5b780ef9c8872df22ac8b1f4bd7beeb47da07533b2f8137ead977ba81f13c75278c237616921efce3
SSDEEP 3072:eKjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:eKam7Rkm1tYpBeh2BAoO
TLSH
T168C3123BAD65A83759A9BB1EA04E0B1F1DF14DB7C920DE52C8D86B0433EA7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 fcc8ecef5d707b7ae381779410b4ff33ba13ca8c8f45eed12127061f3f70e702
MD5 8e4996736c0405acdc47ae010bfe3072
SHA1 02269473ebe1d5ea75754068b684db58c9afefc2
SHA512 cba3313f58c805b29bafdb513027666a92e28eae728f9c483202bbcb67cee465246c3ba8f3037e89bc61c18d42efd8a2405eeac5fccc31d7d762dc9c78df3cf3
SSDEEP 3072:xGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:gm7Rkm1tYpBeh2BAoO
TLSH
T16FC3123B5D65E9775D79A70EB48E0B1E1EF24DA6C930DE42C8D46A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6d4e7e107f80ee53a75b196bd19bc685d7961d3fafef7278e4ca2783ec3ddf29
MD5 19f37d05aed94db6526c79336e4e58a2
SHA1 117670f09698758c036723f116c6c030173fa939
SHA512 988bbb23d004822699d692b3054f77f6fd4b55290420bcc12e253d9cd3638efc54ae91887eff7ec2cf9661f54346db5ea8351e16155bfc4d809c659606e0a650
SSDEEP 3072:DKjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:DKam7Rkm1tYpBeh2BAoO
TLSH
T161C3123BAD65A83759A9BB1EB04E0B1F1DF14DB7C920DE52C8D86B0433EA7CC1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download