hxxp://links[.]mail[.]connect-passengers[.]com/ctt?m=30203246&r=LTExNDI5NDAzMDI3S0&b=0&j=MzAzMDQyNTM1NQS2&k=MyTrip_bullet2&kx=1&kt=12&kd=hxxps://www[.]klm[.]fr/c/_WF55SmOTR6TNJ7WLudy-A

Analysis

user interaction
yes
max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://links.mail.connect-passengers.com/ctt?m=30203246&r=LTExNDI5NDAzMDI3S0&b=0&j=MzAzMDQyNTM1NQS2&k=MyTrip_bullet2&kx=1&kt=12&kd=https://www.klm.fr/c/_WF55SmOTR6TNJ7WLudy-A
Sample260910-rfvlvadk2v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2624	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335229598534589"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe
Token: SeShutdownPrivilege	3364	chrome.exe
Token: SeCreatePagefilePrivilege	3364	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe
3364	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 2388	3364	chrome.exe	86
PID 3364 wrote to memory of 2624	3364	chrome.exe	87
PID 3364 wrote to memory of 1820	3364	chrome.exe	88
PID 3364 wrote to memory of 1820	3364	chrome.exe	88
PID 3364 wrote to memory of 4644	3364	chrome.exe	90
PID 3364 wrote to memory of 4644	3364	chrome.exe	90
PID 3364 wrote to memory of 3812	3364	chrome.exe	91
PID 3364 wrote to memory of 1836	3364	chrome.exe	92
PID 3364 wrote to memory of 3812	3364	chrome.exe	91
PID 3364 wrote to memory of 1836	3364	chrome.exe	92
PID 3364 wrote to memory of 3372	3364	chrome.exe	93
PID 3364 wrote to memory of 3372	3364	chrome.exe	93
PID 3364 wrote to memory of 3808	3364	chrome.exe	94
PID 3364 wrote to memory of 3808	3364	chrome.exe	94
PID 3364 wrote to memory of 4880	3364	chrome.exe	95
PID 3364 wrote to memory of 4880	3364	chrome.exe	95
PID 3364 wrote to memory of 4928	3364	chrome.exe	96
PID 3364 wrote to memory of 4928	3364	chrome.exe	96
PID 3364 wrote to memory of 4260	3364	chrome.exe	97
PID 3364 wrote to memory of 4260	3364	chrome.exe	97
PID 3364 wrote to memory of 1304	3364	chrome.exe	98
PID 3364 wrote to memory of 1304	3364	chrome.exe	98
PID 3364 wrote to memory of 4196	3364	chrome.exe	99
PID 3364 wrote to memory of 4196	3364	chrome.exe	99
PID 3364 wrote to memory of 4496	3364	chrome.exe	100
PID 3364 wrote to memory of 4496	3364	chrome.exe	100
PID 3364 wrote to memory of 1904	3364	chrome.exe	101
PID 3364 wrote to memory of 1904	3364	chrome.exe	101
PID 3364 wrote to memory of 612	3364	chrome.exe	102
PID 3364 wrote to memory of 612	3364	chrome.exe	102
PID 3364 wrote to memory of 2732	3364	chrome.exe	108
PID 3364 wrote to memory of 2928	3364	chrome.exe	114
PID 3364 wrote to memory of 216	3364	chrome.exe	115
PID 3364 wrote to memory of 4004	3364	chrome.exe	116
PID 3364 wrote to memory of 952	3364	chrome.exe	118
PID 3364 wrote to memory of 396	3364	chrome.exe	119
PID 3364 wrote to memory of 396	3364	chrome.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://links.mail.connect-passengers.com/ctt?m=30203246&r=LTExNDI5NDAzMDI3S0&b=0&j=MzAzMDQyNTM1NQS2&k=MyTrip_bullet2&kx=1&kt=12&kd=https://www.klm.fr/c/_WF55SmOTR6TNJ7WLudy-A
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff4d29c728,0x7fff4d29c734,0x7fff4d29c740
  2⤵
  PID:2388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,17894139312998700633,5910739565665245718,524288 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,17522297915479493568,16364466137681702513,262144 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,1792573544500786344,12461298138003900247,524288 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,11726134995567539266,14515806691309875118,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,2025500781464155299,1888066737386983608,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,15527472845431778884,9509255345705210955,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,430879173276023090,11785493167377067942,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,5312938583904831478,8659426930848357836,524288 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5012,i,10064005101927842048,15453648341353413272,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4888,i,13979135294952517722,3810107959517266351,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4920,i,364573089946690023,563663738388496199,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5504,i,13975661474356965105,11083233621743188059,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5616,i,14578334519918489335,3407993434561220233,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6196,i,6111213238443461726,5591573096489410422,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6348,i,13805188146326311792,10295406908371328606,2097152 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7452,i,17291439229886954358,15493217712301566796,524288 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7368 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7492,i,5299634077835724260,10985850367066122131,524288 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7484,i,2844470418017601729,231411207877335373,524288 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7520 /prefetch:8
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7468,i,2848848749000399866,17508036274018894119,524288 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6752 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4448,i,17765617993072696623,17002493612545619880,262144 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,13488691592256629145,12407563672950232452,524288 --field-trial-handle=2088,i,9619279586179832503,9853071051440774837,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 504fe8f3bf67998505ad6f56e14542438a99f8716d5f6eac79a22bd6701ddecc
MD5 74750f68d01348f319a40f3643879a66
SHA1 b7d2f813a013ce1ac167ef8add82d99196eef365
SHA512 f9114a5e039b3fa5fe202f31474c9433289b9cbba20573a3b35329923ecf778372d6b51bce81052623915c7331d919e62c795c5be2528d25d1f29a5bc94b8136
TLSH
T1F8E02BADC861EC271DF91B2920140646EB4003167F91DC0F3A3EC60D8FB5A3A45A6C2C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 57bb3c57abf5d3569d01384679b94006fd10e9795899f3c17111e482397af8fb
MD5 a95470be5af1bdb26096c704a2a89b98
SHA1 bff0b43e8a4fc8a86be66a3f160a8b8054f58517
SHA512 4d9204db039cf47e38eb4df9249ca74d718cb1034cb84374ecc8b786e9b65958eda4e5a56bce1d9c49a13ae74979156ab7e4bf3bf69ffcce0b041a7d22c8a509
SSDEEP 96:SMyraZooLLIX+wiFo2gbwlZHjYuWqd0vGwOMYSfBspWP4rPOdCsy7Po4hTbsnAPf:SMyraZooXIX+wiFo2gbwZHjYuWqevGwQ
TLSH
T10DA1A7599D183200EB900A3AF7F59567FB3C57CD86130E1EDDA9C8F19A7EBD80406563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 c8540246ea0dc430eed09da8da5b4158f63e1dd0aabc25429490983db9550533
MD5 0ad80410ef4ab875f93a285a8fed07a2
SHA1 ff44b42cf516cd73a396b447c89551ba2b65a7be
SHA512 98120609d7fd79011346446f834137768be02f295c5e1657bf419466ec49135a91d7bdea596b779afa458c7972440304ccdbfac47dad27ce291573be9a99a307
SSDEEP 384:Dq7EtAQ4NvlQgO/IueXvBerUe2Z84eMf+qr6pANetkaIaEdnfDNHDlXftFAg7R3N:MZ0yUFY
TLSH
T1AC827FF693ED862D8D5252F0DA183F27CE29091A52683C47C9D99FCBA3F18B0E1D194D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 65dae2435102f0d16cf9564d6c7c382803d9d4436424e6f75d0f4589704b11f1
MD5 3159d377293eac46b0a44d348e5adcfc
SHA1 dadf7cad70bb10f2a2066742d97526813c2c9df8
SHA512 8dc98c323f03447dcf99ea5ca1d44e670f4e988ca6faccca7d5bde1339f71ce9d49b3def8bcb4a082984012888f9fcf4269f51f75ca2fb3afd3c858d7b5180ea
SSDEEP 192:4Rp1IwLR6piv7cpAPRp2q4iCEZl9BHsb+WNn7bZ4pk2PrFeukDqVyIsnAUggWP:4Rp1opuwUXl82rwf32PpCqtP
TLSH
T1B252C62EE95069BB4CDBD22AFA667B53E7F5102225941DC0EAFC8D2C14E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c7248ae921cf069fb33932d2ef64a67a7de93b3a0d4c0c256f93864e3486418f
MD5 dd32d1aff3ab1d343f9c39aa954a2581
SHA1 12cd8e8ba32ef68f4877d5fa9c8b2cac1a4e7567
SHA512 7ae77ee042bd53885f5a0f0bcef5c808fadd858af7612f58dc1e3b20addc962b30758995b4f60d83bd3e2dcfdb252a15f52847f8827a71f1b9a482e5a4b77940
SSDEEP 192:4Rp1IwLR6dzv7cpAPRp2q4iCEZl9BHsb+WNn7bZ4pk2tFeukzqVyIsnAUgGWP:4Rp1oZwUXl82rwf327CqTP
TLSH
T15C52E82EE95069BB5CDBD22AFA667B53E7F5102225901EC0E6FC8D2C14E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6bed85f01bbf86cbb952f00c6957a27030241fe1e6357ae5b8974d982feabdea
MD5 9a3bf0c88c837628ec2d4feaa50b1fe7
SHA1 620eecc96dd10430952b605605cead857bf31a70
SHA512 cd9f4bb3c9b28279d854d1cceb44875d543d07850cff76176e525bac694ce0232979140bd3b81fca55f5928ea093c38470240dde97ef67b8c14ae933d2d846d4
SSDEEP 192:4Rp1IwLR6Mzv7cpAPRp2q4iCEZl9BHsb+WNn7bZ4pk2PrFeukDqVyIsnAUggWP:4Rp1oMwUXl82rwf32PpCqtP
TLSH
T10052C62EE95069BB4CDBD22AFA667B53E7F5102225941DC0EAFC8D2C14E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 bb54e10772a29137572abac5a591dbe99ab11a46dad9abe90f10cc0f464e32cd
MD5 632732e73ea98297b101c7eb7a5ce9dd
SHA1 aca7423b236e6790e7ab40374ebe91cb3167c9bf
SHA512 232c9c61b5b4cb2307aa66aa7a3072e3340a97f420cd540b90ff2e71d39fe509f332e3aa33b409b61ccf2411804e46e32725dc5cb3f4c35e0bd6dd463349b813
TLSH
T13FC01206C401E11BC05603F415F698ECB258FF35EA0B2B5CA7E46B12D8395338015261
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590536.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590536.TMP
Size 96B
SHA256 452fcf8199a882d3330bb69a4cecd734fcf4cbf71ec40c3de793b2c2e9c90671
MD5 58f1857750ee4c5f82f077d8bb34af39
SHA1 68945f93399193f9fe750368e3ecb0c334971527
SHA512 d16dceaf51cb803348034fdd1609ae901452f72e26cd485da7114055c7e3e0213333be5c111e925289faa65e5ef986bc313ebc9886ba3f44f38b2aad0a89823b
TLSH
T188B00265C1037212D05203B126A999D8B9A5DF29C6C72216E2E19A66EC267714739570
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 1fc2120f14a5770de6b94648b63377922e37ad8250c4d4ee422fc2f8bd91d331
MD5 08c6503b31cdca26a649aee40901d506
SHA1 033f2a6c8884b82ff28bfff193a9715c4b950b37
SHA512 684f9b3fecd99801df45753f8ec12437c22fb5015b4973d72210c3e992b38a4ee5a94d899e21a75396ffface7675ad5fb5353f5b47ffff27d5fd8d3063033484
SSDEEP 3072:S6qFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:/qFmUi21rSm8uUVNSlzY/
TLSH
T1A4C31214B9A3BCB3EE9930447BDF2A158D680E818291C50156739D415DEF3C66FEAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9b04d13fb754325bb540840c834f04fb024063c75954737365f2387a923579df
MD5 9ddef3445b4a61f5e54478ad2d5846b0
SHA1 bc56a1b7b3dea927200a6c395d3287a29a7f40da
SHA512 3e3ecd7f7e853da9cdd77ac338ea60b4d3f3978c1c32e97e4f7f98371fa6836ce04cc1749fec284fd40fe8a0d6b2090a12d4c5f1ebac02e1b9ee33f74eb02113
SSDEEP 3072:SGqFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:TqFmUi21rSm8uUVNSlzY/
TLSH
T195C31214B9A3FCB3EE9930447BDF2A158DA80E818291C50156739D415DEF3C66FAAF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 64017063eedcb7222df87d55663fe00151aba05183257a181fad6ea6168d7861
MD5 1ff8bf89529e2d120dafe4fbd482d525
SHA1 0210c69efe49d8ff38ccc1520a181d8382d5b2ab
SHA512 d7351c70ca7b06af8b5b997d6e4663ea3219a00da3058db0d2d7bc1351da699a7d0564e04783eaafa45310eeea970bdd5db4314600e45ad2c4ca044944af4337
SSDEEP 3072:SnFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:qFmUi21rSm8uUVNSlzY/
TLSH
T1DCC3130476E3F8F2EE5930447BEE2A149D6C4D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ba83000691f8ad86865226f30eb4f2db9076f75c7b7981d7cbbf83e771c0769a
MD5 6ae63c2b1a9aab46c35420e39e9d7d2f
SHA1 2c3e0378e77c8e0cca6d9a3444e602ac2a552c2f
SHA512 33d0c420b7975f7d695129683790d05a1155411b8865e1417bcc5d87177aaafee30c8a8d58be49442fa65dcf3744f906deae4378ecb775823786096428655a45
SSDEEP 3072:S6FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:NFmUi21rSm8uUVNSlzY/
TLSH
T191C3121079A3FCB2EE9930447AEF2A158D684E818291C54157739D419DEF3C62FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 99cf4fe9884b4853f344413eaf795e3c07dfc1695a7e97b2853933daadf16a85
MD5 9b74b18ae3404361da083829f7d563d4
SHA1 0b13699be881a3ed300be46fb553b5358e0995d4
SHA512 4e9b53db936aa4a526d80a02d5e2d2b5617f351e82f13182ac728e603113be10c3b758d103042d025aa4a4a6a067db454eae3085cbcbe06dd906196d05c10d07
SSDEEP 3072:SnFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:WFmUi21rSm8uUVNSlzY/
TLSH
T1D3C3130079A3FCB2EE9930447ADF2A159D684E818291C54157739D419DDF3C61FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download