hxxps://www[.]tiktok[.]com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=adclick[.]g[.]doubleclick[.]net[.]/%2Fpcs/click?CIO7IfjWKRXTAP84695-AuGusTkd%26amp%3B%26amp%3Badurl=[//]%2525%2537%2537%2525%2537%2537%2525%2537%2537[.]%2525%2536%2566%2525%2537%2530%2525%2536%2531%2525%2536%2533%2525%2536%2562%2525%2537%2535%2525%2537%2533%2525%2536%2531[.]%2525%2536%2533%2525%2536%2566%2525%2536%2564%2F%2525%2537%2537%2525%2537%2530%2525%2532%2564%2525%2536%2539%2525%2536%2565%2525%2536%2533%2525%2536%2563%2525%2537%2535%2525%2536%2534%2525%2536%2535%2525%2537%2533%2F%2525%2536%2538%2525%2537%2534%2525%2536%2564%2525%2536%2563%2525%2532%2564%2525%2536%2531%2525%2537%2530%2525%2536%2539%2F%2525%2533%2534%2525%2536%2534%2525%2533%2532%2525%2533%2532%2525%2533%2536%2525%2533%2535%2525%2533%2530%2525%2536%2531%2525%2532%2564%2525%2536%2535%2525%2536%2532%2525%2536%2534%2525%2533%2539%2525%2532%2564%2525%2533%2534%2525%2533%2538%2525%2533%2538%2525%2533%2531%2525%2532%2564%2525%2533%2538%2525%2533%2539%2525%2533%2539%2525%2533%2531%2525%2532%2564%2525%2533%2532%2525%2533%2531%2525%2533%2538%2525%2533%2538%2525%2536%2536%2525%2533%2531%2525%2536%2535%2525%2533%2538%2525%2533%2532%2525%2533%2530%2525%2533%2532%2525%2536%2533%2F

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.tiktok.com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=adclick.g.doubleclick.net./%2Fpcs/click?CIO7IfjWKRXTAP84695-AuGusTkd%26amp%3B%26amp%3Badurl=//%2525%2537%2537%2525%2537%2537%2525%2537%2537.%2525%2536%2566%2525%2537%2530%2525%2536%2531%2525%2536%2533%2525%2536%2562%2525%2537%2535%2525%2537%2533%2525%2536%2531.%2525%2536%2533%2525%2536%2566%2525%2536%2564%2F%2525%2537%2537%2525%2537%2530%2525%2532%2564%2525%2536%2539%2525%2536%2565%2525%2536%2533%2525%2536%2563%2525%2537%2535%2525%2536%2534%2525%2536%2535%2525%2537%2533%2F%2525%2536%2538%2525%2537%2534%2525%2536%2564%2525%2536%2563%2525%2532%2564%2525%2536%2531%2525%2537%2530%2525%2536%2539%2F%2525%2533%2534%2525%2536%2534%2525%2533%2532%2525%2533%2532%2525%2533%2536%2525%2533%2535%2525%2533%2530%2525%2536%2531%2525%2532%2564%2525%2536%2535%2525%2536%2532%2525%2536%2534%2525%2533%2539%2525%2532%2564%2525%2533%2534%2525%2533%2538%2525%2533%2538%2525%2533%2531%2525%2532%2564%2525%2533%2538%2525%2533%2539%2525%2533%2539%2525%2533%2531%2525%2532%2564%2525%2533%2532%2525%2533%2531%2525%2533%2538%2525%2533%2538%2525%2536%2536%2525%2533%2531%2525%2536%2535%2525%2533%2538%2525%2533%2532%2525%2533%2530%2525%2533%2532%2525%2536%2533%2F
Sample260821-ff3rnsxtbs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2132	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317614007940861"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
4928	chrome.exe
4928	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 564	2880	chrome.exe	84
PID 2880 wrote to memory of 4512	2880	chrome.exe	85
PID 2880 wrote to memory of 4512	2880	chrome.exe	85
PID 2880 wrote to memory of 2132	2880	chrome.exe	86
PID 2880 wrote to memory of 4472	2880	chrome.exe	87
PID 2880 wrote to memory of 4472	2880	chrome.exe	87
PID 2880 wrote to memory of 3272	2880	chrome.exe	89
PID 2880 wrote to memory of 3272	2880	chrome.exe	89
PID 2880 wrote to memory of 3884	2880	chrome.exe	90
PID 2880 wrote to memory of 3884	2880	chrome.exe	90
PID 2880 wrote to memory of 4528	2880	chrome.exe	91
PID 2880 wrote to memory of 4528	2880	chrome.exe	91
PID 2880 wrote to memory of 3564	2880	chrome.exe	92
PID 2880 wrote to memory of 3564	2880	chrome.exe	92
PID 2880 wrote to memory of 3336	2880	chrome.exe	93
PID 2880 wrote to memory of 3336	2880	chrome.exe	93
PID 2880 wrote to memory of 2748	2880	chrome.exe	94
PID 2880 wrote to memory of 2748	2880	chrome.exe	94
PID 2880 wrote to memory of 3460	2880	chrome.exe	95
PID 2880 wrote to memory of 4328	2880	chrome.exe	101
PID 2880 wrote to memory of 2888	2880	chrome.exe	102
PID 2880 wrote to memory of 5028	2880	chrome.exe	103
PID 2880 wrote to memory of 4928	2880	chrome.exe	110

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.tiktok.com/link/v2?aid=1988&lzdlang=enFSmPWg&scene=bio_url&target=adclick.g.doubleclick.net./%2Fpcs/click?CIO7IfjWKRXTAP84695-AuGusTkd%26amp%3B%26amp%3Badurl=//%2525%2537%2537%2525%2537%2537%2525%2537%2537.%2525%2536%2566%2525%2537%2530%2525%2536%2531%2525%2536%2533%2525%2536%2562%2525%2537%2535%2525%2537%2533%2525%2536%2531.%2525%2536%2533%2525%2536%2566%2525%2536%2564%2F%2525%2537%2537%2525%2537%2530%2525%2532%2564%2525%2536%2539%2525%2536%2565%2525%2536%2533%2525%2536%2563%2525%2537%2535%2525%2536%2534%2525%2536%2535%2525%2537%2533%2F%2525%2536%2538%2525%2537%2534%2525%2536%2564%2525%2536%2563%2525%2532%2564%2525%2536%2531%2525%2537%2530%2525%2536%2539%2F%2525%2533%2534%2525%2536%2534%2525%2533%2532%2525%2533%2532%2525%2533%2536%2525%2533%2535%2525%2533%2530%2525%2536%2531%2525%2532%2564%2525%2536%2535%2525%2536%2532%2525%2536%2534%2525%2533%2539%2525%2532%2564%2525%2533%2534%2525%2533%2538%2525%2533%2538%2525%2533%2531%2525%2532%2564%2525%2533%2538%2525%2533%2539%2525%2533%2539%2525%2533%2531%2525%2532%2564%2525%2533%2532%2525%2533%2531%2525%2533%2538%2525%2533%2538%2525%2536%2536%2525%2533%2531%2525%2536%2535%2525%2533%2538%2525%2533%2532%2525%2533%2530%2525%2533%2532%2525%2536%2533%2F
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa1236c728,0x7ffa1236c734,0x7ffa1236c740
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1740,i,17527537281651690373,15797799794819274759,262144 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,12285726871857988383,1118701616564684108,524288 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,143098070458303413,12495599653671550658,524288 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,18166653487557039546,13570508302296781929,2097152 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,3436834281570977462,6591745162649117709,2097152 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4348,i,11956942082909464021,16759062859045131063,2097152 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4372 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,8338495923590389297,6737068908225286011,2097152 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4632,i,11695042689359692429,5461025998566940647,2097152 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4880,i,11893364297373076617,17552672239040031384,2097152 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,12962482020133794134,6755808347266760174,524288 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,5526086919980761076,8513906277946787569,524288 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,18233592045761460559,11257049232261109739,524288 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,10943875700200206675,6830091854801233995,524288 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5188,i,8440115017779369831,18232500255759840830,262144 --field-trial-handle=1968,i,9162864086755458351,3613769087753890035,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 009deb055d212ba12846edea32e34fb5bd21a341abe586f13d6e532247e40bec
MD5 2619bac44ab00b6ec4ce33235e9382e6
SHA1 887e8677b1e1025743cf643cf04c5ba96fdb5367
SHA512 f1888011cfbc2d78dd25faaedcc1a835d582f3a2f444eaadd85b8f88fe2261aafa2d440473dc7685dfe6ca5ba535a51587ce02da3fbed249dcdc5843d623375f
TLSH
T17AE02B69CC21BC2718FD0B285454468AEB50175B2A81554F3A3D9118CFB063751C7CAC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a1dde45fad5eeb6a6b736140d273ae5219ebbcdcf4f43d0a29bb570410e909af
MD5 98ee39891febaa2f48b5c15affd0d475
SHA1 76698861819413624d87f4df9b82284966eb580c
SHA512 9e5a1f0053145d4745931bea22b9d721b89443e322fa1083c286dcba9b4c8592a1fb1efb7a9852d6615850fc4e3039b1516deff10b52526267337dacc2afa23c
TLSH
T1E751B1FB83F4997E891196F4DA156F1FCE691924132C3C6AC8D4AE2B53E2871D10074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0321985509d4ea60b6ae9973177d9d120cca1f313abf98f120a11d9264f658b7
MD5 9e827e5e6ab64446abf32bb9b15a9ef6
SHA1 090d5fb6bd6eb2032ab812435d37f268c0bce4f8
SHA512 a99ddc3b488ffb87bf9c01a397c1c48ee1b064e12678641a7044ec5cb959f2f61c954a577528230104d6a87e90a0c41cb534ae2472c6d45099a3ba44434cb076
TLSH
T12551A0FB93F4957E891096F4AA156F1FCE691524031C7C6AC9D4AE2B53E2872D100B4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5ae3d0a49e38dc5a7e12f2b96b9c561c471393db7427ee496ded39f1e7a56340
MD5 272444cd9fe1784b1600819ba7091065
SHA1 c6d7817ecba56fea4b2709f077b88740dbccc653
SHA512 fb1ddba8b279adb48e8630a093d65c044ee59e47ca2804a88516a00a89c9fe0de49292d0ec6369c10be0a1574526b759e67e43351d9a9b72eb3ce93fef597154
SSDEEP 192:KRJx96elxqGfGv7spAPRp22KI2XP9wHsb+WNniL9172Ane4c4QzaoUJVyIsnAUge:KRJxfBKYUX/KHKwiT29aJe
TLSH
T14642D83EF914693B6CCBE22AFE667B57D7F5102121906D84EAFC892C14E79CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5900697d1206600e904c77023dbe5d7358ea0be1028d364b3ba46b437708dae6
MD5 14e7965b419524c380789a03253229c2
SHA1 2124a49e3198fc15b1b374823de45baa5955b727
SHA512 e219db6aab87ce2b1c4ca98fa715baee31a1e4ab8cad529ca658515116585565ae88214d78a607ee6d3ea38bf136a3a62bb88a1e1d56af3a714fd7e03b0e03a3
SSDEEP 192:KRJx96elxqGxGv7spzPRp32KI2XP9wHsb+WNniL9172Sne4c4QzaoU3VyIsnAUgE:KRJxfBkY9XmKHKwiT2raXE
TLSH
T12052D83EF9146D3B6CCBE229FA657B57D7F4242121906D84EAFC892C15E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 2b2854a26b33dcc676b8aca96ee633371daba4791c9c7112aa9bc19414cc61c5
MD5 bb62a556ffb4116364a661b3a67b0a28
SHA1 e193680efc75ce30b66a8e6971ada78ca09fdd90
SHA512 ed4572405951cf258c4d62845dbb798ad97304c34c4689ccdc0f26ae4db990157d1a85c956d6a289130e0d17ad2a059b1a16f116181f6d383094c2ef1a80e440
SSDEEP 192:KRJx96elxqGnGv7spAPRp22KI2XP9wHsb+WNniL91729ne4c4QzaoUbVyIsnAUgE:KRJxfByYUX/KHKwiT2saDE
TLSH
T16F52D83EF914693B6CCBE22AFA667B57D7F5102121D06D84EAFC892C11E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1aae05b142c7bc26ac4d45609d4e10ae83e5302768045f928012bfe8cfd7aa85
MD5 a0984722eb8b4e10f5db58d29f2dfe10
SHA1 3d7ea5de4998f239a3c41d964d047c0805f3c02b
SHA512 e02dc8889a7025401d64040a83d8d0d36b7a76a3d3cb42e05cdb7f04282bf7cb097d7aa82cf2ca770b7fbca7a0d6ff7174dfa3d598658b760454300c8f0ee5ef
TLSH
T16BB012608001D502C40603F411426488B314DF18970A1B0343E06E73D8251908419090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587654.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587654.TMP
Size 96B
SHA256 2ea60f5ebaeed338e097c6a36a6a5d723f5812299d9911432cdaae7d7e96e7db
MD5 4c1c6718af286cf884932cc018bb3f35
SHA1 10dcfc4f0de35b1e86ed59a65263d8aea00734eb
SHA512 60951c4cd919e86e701b97a2ea9b18c779e301849e9bfb33e46f41faa1c547d44741741bded2de6044c189161750301621b3139064a7f55392f2b7403e61d43c
TLSH
T16AB00255C1026612E09223B229D5E5D87160DFAEC7031326D2E01A67DD3D67849A79A4
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 025835d7c1b719caea0a7236c1262ebcd881dd421e0c2acd7b1c0e418d8edb9d
MD5 3e303ba50e3109718a4c5d740373f839
SHA1 26df15a1c88e80f9b2ae03645133d6c8074079d4
SHA512 fdc36a42a32810acd315bdd9d26153930f283a9ee4086334b3530b261c6540a60af1318ec00001e6cd5215b3f0f57f9a583788a836712ba5d5e3766a9f035083
SSDEEP 3072:AGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:rm7Rkm1tYpBeh2BAoK
TLSH
T18EC3023B5D75A83759B5BB0EB08E0A1F1EF149A6D920DE82C8D85E0433FA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 8d89bda664c4d57eba5aa8c001030993951320e12b80538922b54a3e27cb25c9
MD5 2f52fef5c0d2dd891cf849f2d7ed5a74
SHA1 d7802a36ed59f812872de9ff1dec0256acf36f20
SHA512 42de55357a600386f1048b81e36fa72fb5ada09b8ee413806b28c0c16c3e6a81a8b5a4c196f712e56a5220a20f579df669fb92a0787997029227ecfeea612d8f
SSDEEP 3072:fGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Om7Rkm1tYpBeh2BAoK
TLSH
T122C3123B5D65E8779979B70EB08E0B1F1EF149A2D920DE92C8D86A0437FA7CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6f23eb8932b84f8c027b2a08e244faf4a130a5df20222c1f2567ce2bbf381d5b
MD5 1918a15cb466ca0f5654e872ee652065
SHA1 eabd546d2ea0dcac7ec454722c397f0f44be4973
SHA512 324d04a441c0107154e17f48a9721586848297102752a42967625e8feea812920afe43db5e950a6bab4fb5e89cc41afff183f06dccbec59e52bb3db562ed0f76
SSDEEP 3072:3Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:2m7Rkm1tYpBeh2BAoK
TLSH
T166C312375D65F83759B5BB5EB08E0A1F1EF149A6D920DE52C8D85F0423EA7CC0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 8cce5444f0722760032647cbcde572a7b9f4a0895c370bc7518349f75824732a
MD5 b91ea1681d02a785ae7df22953662e09
SHA1 602fe7bd721b5573d2950e7eaad3bdb45e99d6d2
SHA512 882b7f649107c56f35431588e57967386c73242277e3e90de5810360e54025d55424950a916df901f9938b015f5a5ad5056b4eebc4afb020833dd13ddb1eb880
SSDEEP 3072:iGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Vm7Rkm1tYpBeh2BAoK
TLSH
T1E5C3123B5D65F83759B5BB5EB08E0A1F1EF149A6D920DE92C8D85F0423EA7CC0A05E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download