hxxps://links[.]notification[.]intuit[.]com/ss/c/u001[.]bdh8gUDEWrCWnaoVQXPudShtkKYfK_nZqsvgxKEfBTpbVnqCyQjZLBVka-3dmR05T41X4gbBBD-DuxPapyamJe3vbJnjzSPT5usow8KCsgXFGt79MxjmZYZA9DTz12dC_sIkxUhc7zSHC6SfE92uhtHNQXmH3j-VKQLzpKHBKoEwVbPE9Lunh21kYv6m67ldvhQHAVuv8vNXhFW-YxcxL5xMbgLJ3-80NEv7ut0VRLSVK7oSZjfzVMg8kJ1surLEZjSMB9Mtjhg2IdaQuZxLQ9QXzwApVCEkmfKLx8QLy-dpNKLRRhX9OALHqOc4x9No/4ta/_pnfJ7cwS3m6LXxMHFjoqw/h2/h001[.]-hliYNOfDEP4M5yhAMLAE6jjbOzm2A3gwpbQ13mpK9U

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://links.notification.intuit.com/ss/c/u001.bdh8gUDEWrCWnaoVQXPudShtkKYfK_nZqsvgxKEfBTpbVnqCyQjZLBVka-3dmR05T41X4gbBBD-DuxPapyamJe3vbJnjzSPT5usow8KCsgXFGt79MxjmZYZA9DTz12dC_sIkxUhc7zSHC6SfE92uhtHNQXmH3j-VKQLzpKHBKoEwVbPE9Lunh21kYv6m67ldvhQHAVuv8vNXhFW-YxcxL5xMbgLJ3-80NEv7ut0VRLSVK7oSZjfzVMg8kJ1surLEZjSMB9Mtjhg2IdaQuZxLQ9QXzwApVCEkmfKLx8QLy-dpNKLRRhX9OALHqOc4x9No/4ta/_pnfJ7cwS3m6LXxMHFjoqw/h2/h001.-hliYNOfDEP4M5yhAMLAE6jjbOzm2A3gwpbQ13mpK9U
Sample260818-1bf3bs1dra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4100	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315621193040850"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{572A28E2-FF6B-4AD8-9AD2-FB6945426E54}	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
3120	chrome.exe
3120	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe
Token: SeShutdownPrivilege	5108	chrome.exe
Token: SeCreatePagefilePrivilege	5108	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe
5108	chrome.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 2012	5108	chrome.exe	85
PID 5108 wrote to memory of 2032	5108	chrome.exe	86
PID 5108 wrote to memory of 4100	5108	chrome.exe	87
PID 5108 wrote to memory of 2032	5108	chrome.exe	86
PID 5108 wrote to memory of 1612	5108	chrome.exe	89
PID 5108 wrote to memory of 4060	5108	chrome.exe	90
PID 5108 wrote to memory of 1612	5108	chrome.exe	89
PID 5108 wrote to memory of 4060	5108	chrome.exe	90
PID 5108 wrote to memory of 1136	5108	chrome.exe	88
PID 5108 wrote to memory of 1136	5108	chrome.exe	88
PID 5108 wrote to memory of 1108	5108	chrome.exe	91
PID 5108 wrote to memory of 1108	5108	chrome.exe	91
PID 5108 wrote to memory of 3808	5108	chrome.exe	93
PID 5108 wrote to memory of 3808	5108	chrome.exe	93
PID 5108 wrote to memory of 3180	5108	chrome.exe	95
PID 5108 wrote to memory of 3180	5108	chrome.exe	95
PID 5108 wrote to memory of 776	5108	chrome.exe	99
PID 5108 wrote to memory of 776	5108	chrome.exe	99
PID 5108 wrote to memory of 2216	5108	chrome.exe	102
PID 5108 wrote to memory of 4252	5108	chrome.exe	105
PID 5108 wrote to memory of 4252	5108	chrome.exe	105
PID 5108 wrote to memory of 3004	5108	chrome.exe	108
PID 5108 wrote to memory of 2604	5108	chrome.exe	109
PID 5108 wrote to memory of 2604	5108	chrome.exe	109
PID 5108 wrote to memory of 780	5108	chrome.exe	110
PID 5108 wrote to memory of 780	5108	chrome.exe	110
PID 5108 wrote to memory of 1056	5108	chrome.exe	111
PID 5108 wrote to memory of 1056	5108	chrome.exe	111
PID 5108 wrote to memory of 2216	5108	chrome.exe	112
PID 5108 wrote to memory of 2216	5108	chrome.exe	112
PID 5108 wrote to memory of 1544	5108	chrome.exe	114
PID 5108 wrote to memory of 3492	5108	chrome.exe	115
PID 5108 wrote to memory of 3032	5108	chrome.exe	116
PID 5108 wrote to memory of 3120	5108	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://links.notification.intuit.com/ss/c/u001.bdh8gUDEWrCWnaoVQXPudShtkKYfK_nZqsvgxKEfBTpbVnqCyQjZLBVka-3dmR05T41X4gbBBD-DuxPapyamJe3vbJnjzSPT5usow8KCsgXFGt79MxjmZYZA9DTz12dC_sIkxUhc7zSHC6SfE92uhtHNQXmH3j-VKQLzpKHBKoEwVbPE9Lunh21kYv6m67ldvhQHAVuv8vNXhFW-YxcxL5xMbgLJ3-80NEv7ut0VRLSVK7oSZjfzVMg8kJ1surLEZjSMB9Mtjhg2IdaQuZxLQ9QXzwApVCEkmfKLx8QLy-dpNKLRRhX9OALHqOc4x9No/4ta/_pnfJ7cwS3m6LXxMHFjoqw/h2/h001.-hliYNOfDEP4M5yhAMLAE6jjbOzm2A3gwpbQ13mpK9U
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb6773c728,0x7ffb6773c734,0x7ffb6773c740
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,11730576462625843392,12448966337338087975,262144 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2116,i,16815749909811017430,4224665892405339240,524288 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,7325400382560480915,5283561207582823034,524288 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3008,i,14655365973913021093,11616371531471052496,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3028 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3012,i,12096494488486504864,3992743643287559350,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,16464398256307052098,11555610119427350102,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5072,i,7864404204655859317,12789558479117181393,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5076 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5248,i,15416912101151544148,16985210747941508131,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5272,i,5091115388966925659,3714877993031621654,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,18379569299423522539,17088455225296557024,524288 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5460,i,644221766571998712,16108953307464484768,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,440251817268217099,16108775055664906304,524288 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5068,i,7713802198824842343,13234503219038488612,524288 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --init-isolate-as-foreground --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5280,i,11116605633879640540,17146062799977455508,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:2
  2⤵
  PID:780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --pdf-renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5200,i,18425558588640085483,11348495125775105940,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6544,i,10001695293531824439,3604891425635596732,2097152 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,658544027435331718,15628665749985850464,524288 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6692,i,5004255608081014537,14907479741872499651,524288 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,7541972747460772536,8703856839677430068,524288 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5752,i,18083659166198642398,16564122108742897897,262144 --field-trial-handle=1976,i,11993728350694502870,17535237583645416032,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6d33e8c90d5f8b72c5d89fb9f26e9c6c1eb9d51290241e44d6de7875d4c1729c
MD5 4799031e96a98cdc17895c1b6763d286
SHA1 7f99c4f656237fd8b8d59176c324d87a7baf4266
SHA512 8bd71e028973d34d723c586801698181a20f7e63af82dbd8b7dba17278a4f1cd3a36a2000848651aa80e69bc8f4a50febdd6a4591ce1071477ea649949344262
TLSH
T157E02B69C861EC6B28FD0B19E0145786DB5513AB2A418D4F7A3D800C8FB163A4689C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 be45bf2dfe9bae93adc3f48f3b106d660bac841a4d5ca9af9ba279dbc468be39
MD5 52a83909ea80bf417744bbb200467fcc
SHA1 ff54ed5abdc6e120ec0c9c3f392141af6bf3750e
SHA512 d0272fecbd8a931364095cb665dea1f520659cef6685e193e8b14dc1b8adb06be456b0623c5837e8e9fb57175e703b634b2c7965494e2ef965cdfb4fc86436fa
TLSH
T1FE411165C7C1A795FFC830B4C599E98864A01EC7054E1B0FEB98BC6BAD532DC85C09E2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_connect.intuit.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 28052e6602afc28b13259c26cca84dd72e90761f3806137377a0a0e1d1923adb
MD5 890dc0ba20292a0940bcdda85f165715
SHA1 54fd85fb652cd17d5e6d14e4760ae72301915e6d
SHA512 dee2108de9709b9d0eebfa22444bcc720cabc212f32ad7abbd68fefb41bb4938fb49423732a26635de669337d1099704e88bd8ed9fa169749e74719f2c4e9daa
SSDEEP 192:DdoKaIaEd7yyi2NS4PpwDG18UBRSiXTL1iw6QCH0vjhq:DdoKaIaEd7yyi2NS4PpwDG18UBRSiXTK
TLSH
T1A7D167F783BCC62DCA1295F4AA14AE1FCE690520435C397688E4BE1BA7F3561E101B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e4134d2d50a0015687261b3f4b693906867f2eeb48794062b8724a37b6198170
MD5 f3e3bf0238025c766ac59b7b027cfad1
SHA1 0f3bd9d7c7750d159c90c54c36c83b1382f9a905
SHA512 4027b7d2a51c418a98e2797e179a34777e1a44f91546515525df70b56410107f4bb0a769e6a54f14df83abc2e28885e56afe8322ee34ed4c07c2db85c9785929
SSDEEP 192:IRf7nu5fCoGTv7rpAPRp2dHb9+Hsb+WNnq0kof2Qv3DaBCOVyIsnAUge:IRf7RrHUXo8wRf2QLape
TLSH
T18C52B62EAA102ABB6CDFD229FD617B53D7F6102124952E84E7FC891C15D76CC222705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d058d228e8731e2d63d7a3da9059c2a98dc44ce39c0f952b5bdbaedfa9c6fab2
MD5 dc738866a54cc0917bde2c616c302784
SHA1 7a0e51e6abf263f0fe3b4af7b3003e7edc9fa45e
SHA512 9c6b429d1310f8008a758b544bc426ecabf464751a8ea21e6c1a1290a2a2638c84ac48aaae4e9e9515028610f16c4b20850022a5c703889faec14206dba8d070
SSDEEP 192:IRft8S6nu5fCoGBv7rpAPRp2dHb9+Hsb+WNnq0kof2cv3DaBCgVyIsnAUgE:IRft0RRHUXo8wRf2cLazE
TLSH
T1BE62C72EA9146ABBACDBD229FA617F63D7F6102225812E44E7FC891C14E76CC3217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 4b0b7015e7437372408f378b4f83ff97f80b6ae90c1aa5f2f35f4d876d67fe26
MD5 4a29dd15c72e0ee9c5eb7cc13ae89168
SHA1 a5c797ab10b362e0d77bae1435e761b2fe6d45a1
SHA512 cd6aff6a5582912d88a61e2d2fa98613902a7203b23f4ef639b3b768c86f692b353350ea16ed3cb4d63f6efd7e2eae503f8935a99d238b8cdfab34f21d3e9548
SSDEEP 192:IRft8S6Ju5fCoGpv7rpqPRpIdHb9+Hsb+WNnq0kof2zU3DaBCcVyIsnAUgE:IRft0PpHKXS8wRf2zwahE
TLSH
T1BB62D71EA9146ABBACDBD329F9617F63D7F6102225902E44EBFC891C14E76CC3217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a66463b0a30959d1a6cfc9ecb159b6200802088c95ee1f0fbfa5f001fa940775
MD5 08ac6e95173038deb17c48983bdbae4b
SHA1 229094c2283f7a88cf18556969f43fffd5c9d216
SHA512 a4fd453731ff7c7a79b4a3c9403ed83dfbcc3a201044aa25beda466768f6fe79569507ca28997b64988ff2daf7b8e3a504f18465048278dc0404f47820014940
SSDEEP 192:IRf7nu5fCoG3v70pAPRp2dHj9+Hsb+WNnq0kof2n3DaBCOVyIsnAUge:IRf7RfgUXM8wRf2Tape
TLSH
T1EC42D62EAA5069BB6CDFD219FD517713D7F6102120952E84E7FCC92C15D76CC222705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4205d3071834d730a3c97ec031ff4305013fd53593c6be6c8f430bb6c3aaa41a
MD5 7fdad95d973b36a09df26fc93d0a2131
SHA1 2a5722771076b6c6f9f9afce4794e72023656363
SHA512 9d497c72c82def657e5e1ef9d321ad73b18ac482f8572f0eb0ff1326c90cf66e9e486c3727e0d4c4100ff596dce90ab02fb8b97c60d31485f8d92647fdaee9cf
TLSH
T15BB01250C0019752C10202F41163948871149F22970B270143F07E3AC82B1508014151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5862eb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5862eb.TMP
Size 96B
SHA256 a3ffec8b45b8b1fede1b7facd78fc97342fb4fd2f0111d808c339a516190d201
MD5 4657d5c940d5c32a346e9072bca521a9
SHA1 aa2a4d593b958babb5c78cefaa643f0f3ae144f8
SHA512 4678b82944e2ae92815ebd80911717b7a336b9ada8508ce559b33e63d3ffcc4de6c5669de1d16018b7266ad99556db093ecaa9cb765d920e667c7c5672d26f49
TLSH
T1A7B022A8C8022302C23203B02CA0C0C8B028CF22CB830202C2E23E33CC28320002A220
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 1c3538384dd0e70d1a3724353ec3814deaa656827d4214ea36baf9239528a0e2
MD5 2414c53c41dc6c63b530ab227763f1d9
SHA1 f6ed7c42f4986cda346a0fdc075373b95e016df5
SHA512 e89eab9d7f9c626e1963bf9b8fb70876d3ee59a5d1a5d280415e8f5e01edc7b320a77c5b127339f86752829c5993783317685841f28196b312061557231a92f9
SSDEEP 1536:MZpyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:cnqfd7NtZL8cHQRZEQ6Sps3
TLSH
T168C30237ABC21E339DD3DB60B5130F9793F644AAD034D301EE6D3BAB6883595A48249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c70a6489bc0e2014b54708e9b55c374b1770db4ce4617c98146351cab7ba279c
MD5 5b17f243d37acd4af88a7b322b9fe07c
SHA1 f5ded6a454b74b9d0ceb3bc26f37e75f5d0c3d43
SHA512 4dab8a7ac00ced680262dd89261f4738e1fa3cc22c0d3920cde58804fb42fd0df586e8dc080070466cddd8523826a01ba8ffeed93c6c1de1f9a41c4a9d41d80b
SSDEEP 1536:bmLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:6qfd7NtZL8cHQRZEQ6Sps3
TLSH
T1ACC30237ABC21F339D92CF64B9530FD6A7B644A99030D301AAAD37FB7C93591684249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 97bfa06e3768711916129eb4a2db5b9e53a70dc2be2b610ae866720f1d85558b
MD5 56eb50964ca6c1946edd02f509155fa6
SHA1 4299254b88e06e4df5f9035b58e2b8c299dc0eb4
SHA512 7a7d50e47787b83b85f60565d8d05d1613842ac1dfe3ba5b0d1b0fbc8b8e0d9521a54c941d26d02165ada71032aacd29c467ffd879ab970bb1dda014c6193745
SSDEEP 1536:xAQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:Wyqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1E4C30237ABC61F339EC3CB74B9530FD797B644A99034D301AAAD37EB6883591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 82a98738039e338b696ad1b37fef7021e122c7f4cc382d981e42ed0a4d14c8c0
MD5 7478920774cdfaa673aa15572c25000f
SHA1 cf5214daea2f15bcb2a769d359c26565609f4117
SHA512 def72aab0a76599c8f5f360aadd98c0e5b086404e336b87a77af02f37cacf6199717fde57bb10048c76d9a3b3763788e645713cfcebb9fc8d80f302030299e2d
SSDEEP 1536:M7QyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:4yqfd7NtZL8cHQRZEQ6Sps3
TLSH
T1BAC30237ABC61F339DC3CB74B9130FD797B644AA9034D301AAAD3BEB6883591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download