hxxps://xoici7hbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&_email=mjohnson@serverless-solutions[.]com

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
Sample261023-e328zscb88

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	8	[email protected]	3056	chrome.exe
Email address	13	[email protected]	3056	chrome.exe	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3056	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
4988	chrome.exe
4988	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe
Token: SeShutdownPrivilege	2456	chrome.exe
Token: SeCreatePagefilePrivilege	2456	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe
2456	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4640	2456	chrome.exe	85
PID 2456 wrote to memory of 1192	2456	chrome.exe	86
PID 2456 wrote to memory of 1192	2456	chrome.exe	86
PID 2456 wrote to memory of 3056	2456	chrome.exe	87
PID 2456 wrote to memory of 1228	2456	chrome.exe	88
PID 2456 wrote to memory of 1228	2456	chrome.exe	88
PID 2456 wrote to memory of 2108	2456	chrome.exe	90
PID 2456 wrote to memory of 4928	2456	chrome.exe	91
PID 2456 wrote to memory of 2108	2456	chrome.exe	90
PID 2456 wrote to memory of 4928	2456	chrome.exe	91
PID 2456 wrote to memory of 1756	2456	chrome.exe	92
PID 2456 wrote to memory of 1756	2456	chrome.exe	92
PID 2456 wrote to memory of 3712	2456	chrome.exe	93
PID 2456 wrote to memory of 3712	2456	chrome.exe	93
PID 2456 wrote to memory of 4952	2456	chrome.exe	94
PID 2456 wrote to memory of 4952	2456	chrome.exe	94
PID 2456 wrote to memory of 5112	2456	chrome.exe	97
PID 2456 wrote to memory of 5112	2456	chrome.exe	97
PID 2456 wrote to memory of 4392	2456	chrome.exe	100
PID 2456 wrote to memory of 4572	2456	chrome.exe	106
PID 2456 wrote to memory of 1908	2456	chrome.exe	107
PID 2456 wrote to memory of 4820	2456	chrome.exe	108
PID 2456 wrote to memory of 4988	2456	chrome.exe	110

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9bd0ec728,0x7ff9bd0ec734,0x7ff9bd0ec740
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,14784438167552871729,2375898633027862981,262144 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,15277258351701297248,12455813103577074753,524288 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,13559675313347376127,132829663375858756,524288 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,1761198192779812975,11739016359683242817,2097152 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,15661362804797457192,18115056091905679952,2097152 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4272,i,12012731973937662386,16692585281562753247,2097152 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4288,i,9710110415844287681,14325883702088990749,2097152 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3264,i,2467808236072989695,5641900865040170285,2097152 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4724,i,13087131130487711091,6036950198435849556,2097152 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,18024858468199316070,15648824975415099610,524288 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,15848039087595581891,6905360955306672818,524288 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,5842965411050953461,1173629992212873635,524288 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,9800354103059440919,4335895649665811237,524288 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5060,i,11533484286247988199,14750424721084537246,262144 --field-trial-handle=2012,i,12716629999424469637,4565845639983152658,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32e02d3d-37b5-49b4-8710-08379a9bc496.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\32e02d3d-37b5-49b4-8710-08379a9bc496.tmp
Size 189KB
SHA256 4e8449c76a989200c32520113c4e1bfbd4daa232eaac235db8129b68298cae6a
MD5 5b291be8f77f8aff90764b4ef0c2bb63
SHA1 2963f34a0d712ac0db0e58a741862321561070ac
SHA512 3cd552119445c781abc860648ef1da4b3e6f2b87432de79d5800bed3fad8afce83f8fe22de2b05e8c1bd7c24f9f6cc19f800c1cedca73f80ad76fbb5b6c0ef6e
SSDEEP 3072:IJV2o8Z6I2qrn/ugdsKsQVpimWVIZA+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pI+:In2o892YDVwZR+hFD+7t56OD9ZfSAppL
TLSH
T1CC1412B2EAD098F7CABD7111E29A57419EA179ED21DD2B04405A8F8BD1DFC4C0633E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47e41c3d-140d-4397-957a-82f206f9bb4f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\47e41c3d-140d-4397-957a-82f206f9bb4f.tmp
Size 130KB
SHA256 620bc9897affce2a94b04897519b96ba583a76a1b767e1415b62943a517b04e8
MD5 a34b2e05e13d9a3ce24cfa673e5676a9
SHA1 43b1fe88ac512ef239075d5231eaa4632713574c
SHA512 909cba92ddc4049cbe0551bf61f9b8342df121ad57044297bc77c0559235d281219db920e6ae7590b9b13f2570000908d232cb23b101f6bed253e045ba2873e5
SSDEEP 3072:wJ8+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wq+hFD+7t56OD9ZfSAppr3
TLSH
T129D31232AA94C8BBC9BC6541F257A300CD626CED41DE7A09444A9F8EE09FD5C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57629781-12b6-4641-9c4b-679947d7b258.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\57629781-12b6-4641-9c4b-679947d7b258.tmp
Size 131KB
SHA256 2a81a5e27c995448f9c6f81555cfb2c4242ca8c8827ba09bf3ff9683f94c2576
MD5 71b8eaf49df567f1a8a9796616c1b30b
SHA1 3c9b3bf0a0be16b154f01dbba5e00b43904329c2
SHA512 588bc4a5b94959571762d8cd478140d3b00059fa507bbce41df5c478d76cef8cb6c1048ac6c4376823d552499c2d2a796f1f33183d6dabbca2c12afbd7aa0a4d
SSDEEP 3072:fJL+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:f1+hFD+7t56OD9ZfSAppr3
TLSH
T1DCD31232AA94D8B7C9F96541F257A300CD626CED45DE3A09844A5F8EE19FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c5642bf-90db-4987-86e1-deb7e04ac5f3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4c5642bf-90db-4987-86e1-deb7e04ac5f3.tmp
Size 12KB
SHA256 b64ccf6ed4bf4088f1901a89fe0ca163d685d66f5e832b36422ef64a03b93503
MD5 2a6cfa594cc858ef942f8906b0d4e0d3
SHA1 1fb176279eceb13c18cd196283d9cc3a59b496a5
SHA512 2fb0c2fcc8ebbb852dfd02602a1a4213dde2056a0c1f36813159ed622e81ca8a061f1a526b43dc208af4c2dfd4534f8d8596374807cd9127c86abafdc9f280f7
SSDEEP 192:4RH5FvY7NpCv7VJpAPRp28yk9fHsb+WNnUFhhwp2cvV1ekoLVyIsnAUgE:4RHjWOvUXjfhwGhe2cvhUE
TLSH
T1F642822EAA10797B5CDBD31AFA617B63E7F6102225901E80E6FCC93C15E7ADD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cf1bcf1-8063-4b8b-abe1-ec55c8a6f26a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5cf1bcf1-8063-4b8b-abe1-ec55c8a6f26a.tmp
Size 414B
SHA256 eb6fae4288d57d3c7d4bdf2efc2158319c533a33e8c4b6a251d289cde01d0c3b
MD5 477c445c9a2599a5ff18c8a54fcdf13d
SHA1 f3f09377e76919dfdc1177d8524aa17b3deed286
SHA512 42000c587242b9bcd65aab4bc096e95286492956c4f796d23a27800fe4d1adf54a3992fa564b7a979105bbfa981d6ae9daf472594eedf97ddad38ab21608e346
TLSH
T1BFE02BAECD20AC3718FC176960904746E76113572651958B773D811D8FF1637468686C
MD5 SHA1 SHA512 TLSH

Submit Download

8e2c3a37-3bc2-42f3-8a28-a04abdbbcbac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8e2c3a37-3bc2-42f3-8a28-a04abdbbcbac.tmp
Size 12KB
SHA256 d1360b283497ff4db08c9cac21c1e692cc0c193b78e0bc4461df5272c2e021da
MD5 e9b51eb745075087c7205b556f585373
SHA1 a89f98ef07c86766e57a72cc413f6280b89e08e0
SHA512 459f1e51aecc60c6c0015b030af3286bf01c91d642d562b3b8106cf27d79267bce1ac429d5a2b6c0386b723dafc90e6d834e5c48de8c74520efd7dddd31b39b5
SSDEEP 192:4RH5FvY7Np+v7VJpAPRp28yk9fHsb+WNnUFhhwp2cX1ekosVyIsnAUge:4RHjW6vUXjfhwGhe2c7pe
TLSH
T19242832DAA10797B5CDBD32AFAA17B63E7F6102225901E80E6FCC93C15D7ADC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 720B
SHA256 3d2743eff104b21cac8b3b6c6d0061d3b4b5e9fa4ab3109e190389578b14d8db
MD5 2cc2e319dbdcaf407c1600020c3ea4de
SHA1 12df862a445d0f4bd41ad8c50e39e2a50e274893
SHA512 81222e4c69b79b2c73635ea9d17b18d8603c53289811ed205f1655903cb3a390f0734c721058d8cb5e3e992f4ad6e97d7f229a8972503fa257f9f17a469aebfd
TLSH
T1C10124C4B481CBA1EB2D2A3E54C637037135978A64DFCE378395D4B23521F9A1421679
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.triplekey.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

2b7cef4f-ba89-4420-9abc-0ec42c32de2b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2b7cef4f-ba89-4420-9abc-0ec42c32de2b.tmp
Size 10KB
SHA256 8dfb46c8fffce06262df0961939cadf3a40dfaf9a6ed41ec7b5a6ebb0f7b935e
MD5 4f3aedd805af3d17f9723d87f766e1e7
SHA1 6ae46c30795e0e5903be57270fcadd54fccee9fa
SHA512 7659dd74544f8e78e82912a9b9cf1a758e3f00719a23b1ec5e30ab8efb737b9631eaf8ce4361ca4e05d4be7eaaf390e5623f4d85228e353874d7ee2cd0b4aa95
SSDEEP 192:DOVh29KQK1eQaIEadRS/SoYdnjEQ9s64ne1H+QVnEh1G4GqY1QtmBbapTXY3qI/S:DOVh29KQK1eQaIEadRS/NYdnoQ9s64n3
TLSH
T17E227DF383F8CA6E99019AF496146D2BCE9D0524531C3D66CCE8FE1BA7E3571E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

542bb57b-bec3-4fa5-844a-c1d89d2c6f53.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\542bb57b-bec3-4fa5-844a-c1d89d2c6f53.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 072a41fa28b6228f59ce8b85950dda7948fd406aa8ff5155aeac56c39c5f7ec0
MD5 b004998f5e9445f6fc0c76cc57b2e0d3
SHA1 070688fa870b38aef38f6af46de2ca1be2187ff0
SHA512 3e7e866ab188fe2dcce33c2eb2e087d7efa4bd3c6b1f5e8383245efd14ec42d4718341a253a9a8b4949f537f59297743c2173286366f1486d76e45e0712a5067
TLSH
T118B0124AC4415702C44202F419EC14D93594DF11AB06130542F01D25DC35690802B095
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 0eaedaa456562c4674ec95a862d78b246c1477b88ad0f7fbd195e0f9e44afd4c
MD5 e62c91e2c0762add3b5f0f90551b6637
SHA1 620445196cc6c116a2f4ccae3e59f5826f728a5c
SHA512 3f93109d75644f3a230c2c0d2663d57ceda279a8ac822526081b83852d26ce669812ad61e71e1749ac9f96f404c2a03a369b0864a26672cf320dd5b9a676daa7
TLSH
T1F1B02223C0022302C00203F02CA080C83220CF20CB03032383E00A32EC30BA08C202A0
MD5 SHA1 SHA512 TLSH

Submit Download

a575e6e2-9e6e-4e85-8b35-ac722b012d6d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a575e6e2-9e6e-4e85-8b35-ac722b012d6d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c352b2f4-45d8-48ec-b23b-1abc4cfa67d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c352b2f4-45d8-48ec-b23b-1abc4cfa67d9.tmp
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eade4f33-63f4-421f-9827-a1ffb099325e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eade4f33-63f4-421f-9827-a1ffb099325e.tmp
Size 131KB
SHA256 29f7ccc992db170e575f8955fcd00a3bf6d7b1b1cca8604a96920c78ce9293af
MD5 dfb9cdf6279d85f9d94b92d3f876deeb
SHA1 e90d80f4354c5e6451d90fb9fe0cd5c28186107e
SHA512 598a6cb463325475add7c0e3b54eb1709a154987b697fcde4cacef297c39494c3b9ef8d01e9dc1f7aec90fec56df4ae010295d3cfbdd586dcbc3bf774812eee3
SSDEEP 3072:IJL+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:I1+hFD+7t56OD9ZfSAppr3
TLSH
T1C6D312326A94D8B7C9F96541F247A300CD626CED45DE3A09844A5F8EE19FD4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download