hxxps://xoici7hbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&_email=mjohnson@serverless-solutions[.]com

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
150s
max time network
146s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
Sample261023-e328zscb88

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	13	[email protected]	2116	chrome.exe	1
Email address	8	[email protected]	2116	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2116	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
5056	chrome.exe
5056	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe
Token: SeShutdownPrivilege	720	chrome.exe
Token: SeCreatePagefilePrivilege	720	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe
720	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 2260	720	chrome.exe	84
PID 720 wrote to memory of 2116	720	chrome.exe	86
PID 720 wrote to memory of 4844	720	chrome.exe	87
PID 720 wrote to memory of 4844	720	chrome.exe	87
PID 720 wrote to memory of 4932	720	chrome.exe	88
PID 720 wrote to memory of 4932	720	chrome.exe	88
PID 720 wrote to memory of 1656	720	chrome.exe	89
PID 720 wrote to memory of 4380	720	chrome.exe	90
PID 720 wrote to memory of 1656	720	chrome.exe	89
PID 720 wrote to memory of 4380	720	chrome.exe	90
PID 720 wrote to memory of 1472	720	chrome.exe	91
PID 720 wrote to memory of 1472	720	chrome.exe	91
PID 720 wrote to memory of 1044	720	chrome.exe	92
PID 720 wrote to memory of 1044	720	chrome.exe	92
PID 720 wrote to memory of 3576	720	chrome.exe	97
PID 720 wrote to memory of 3576	720	chrome.exe	97
PID 720 wrote to memory of 3296	720	chrome.exe	98
PID 720 wrote to memory of 3296	720	chrome.exe	98
PID 720 wrote to memory of 3588	720	chrome.exe	100
PID 720 wrote to memory of 3916	720	chrome.exe	105
PID 720 wrote to memory of 1188	720	chrome.exe	106
PID 720 wrote to memory of 3932	720	chrome.exe	107
PID 720 wrote to memory of 5056	720	chrome.exe	108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffff188c728,0x7ffff188c734,0x7ffff188c740
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1608,i,10155858658543064869,14037153005110064448,524288 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,8796942335459190983,11961344452975551660,262144 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,13896810208645039954,13395546351205450614,524288 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3088,i,9372382118393027159,10178192048097817981,2097152 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3092,i,14253350450914094712,8364974870736520516,2097152 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4068,i,12994591991596753855,16246481657100309228,2097152 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,3833627068383480282,4419881978008912207,2097152 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3372,i,11474773249189763174,13310998227589344445,2097152 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4944,i,5374066171217489125,13873887966625084374,2097152 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5612,i,14837456747886276546,5988997851931018647,524288 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,14326986378191336954,9412929000731286832,524288 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3068,i,5707599086443217535,11822236257402810009,524288 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,15784940949204088503,12324997620128175934,524288 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=500,i,5490793733581332276,15079015797732206909,262144 --field-trial-handle=2072,i,13729142633827425697,12290438111481436995,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

15306cec-1339-4c50-b728-000e2944a1a0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\15306cec-1339-4c50-b728-000e2944a1a0.tmp
Size 188KB
SHA256 3bcb09804f9a93b2639c58d6cac21d1a2d574890e128a7efd637af427c4bdc5a
MD5 1e5daf6acc63539195106a3fd11a36f9
SHA1 be21a5cea45044bc4682fa1b77e4bf4bf4f18736
SHA512 6dd7272c82abe825a2cc18727828ade577de367fb659c2911394312f6c3078adc4904449b17e6fb6888317809cc53ade89d81e4607625cb225f33017f7a578b0
SSDEEP 3072:WKSRUcYz5sYnkqE8As2DIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKjD:tkUFz5fnkqEC2rPtbmf1K49XLWbEPi4m
TLSH
T1651412506E05BCB85EECEF6171E05D0586B8CD5B86397BE668CF3F8805A76C98348C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a535511-4d89-4b18-af07-6240e318da97.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4a535511-4d89-4b18-af07-6240e318da97.tmp
Size 132KB
SHA256 294f63ca2fe3af204619383fb2fa1f8989b35aa11ac68216a047c5636458687f
MD5 34402db8476265c16ae48b7f821f8cb9
SHA1 bb1e08e7eba8c76235f004f2bce98c0820b894e8
SHA512 e756d64f732a1fa3d737c3a65d703c60b37a50a77ad4479d51ff10ac85a51524c7b5d3e7feedc667feb097ea249b1d03fc39c3c7bde6f5bd98f101ea1350a0f2
SSDEEP 3072:2IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:2Ptbmf1K49XLWbEPi4NTKlLzh
TLSH
T139D312213D05BCB4A9EEDB21A1901A16EAF8D94F953D3BE65CDE3F4805E3699C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0493b854-462c-4538-863b-3ef2d418d1a9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0493b854-462c-4538-863b-3ef2d418d1a9.tmp
Size 17KB
SHA256 bc874b5dfd433743339ca27fbc016d54b007fab3e56af9f017a931025cb0f537
MD5 8d3394a14b12f06ecbe650f06b4881fa
SHA1 d4c8ccc659c5c983f73adedfc2f5491607ac031e
SHA512 5052397393a9e12e611402bc4ac104433e8a02a13f8c7f9236e7f653a48cb0a7aaac61660c212ab456241d0ca72e689c0cbd6c0186b51f3570b8c09ec3b374b4
SSDEEP 384:K0juV7KxkXqKf/pUZNCgVLH2HfgslRU7pLuLceScdXODu1+ErU3pfHGeXTuxL:KYuV7KxkXqKf/pUZNCgVLH2HfgsDU7p0
TLSH
T15972E967AC4CAA3B0FD4CACCD8277F4FEDB5025A65D9886443FA982503D5ACB11061E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22087578-7d76-4e69-8835-f4ac6956fd0e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\22087578-7d76-4e69-8835-f4ac6956fd0e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

2b2477c1-3dd2-4f1a-ae32-9eb9fd24b8f3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2b2477c1-3dd2-4f1a-ae32-9eb9fd24b8f3.tmp
Size 414B
SHA256 9212b8368999b13c08759c5c745b095146eef5493ca1501279b432793a6f579b
MD5 13a0f4db1427f8aa4c0daed9657a9a69
SHA1 201dfe0005c1130a4d240f420aec6d0fe591dae3
SHA512 c166e5b70da18e34b55b87139e7946a6434771e3cef1f33f8514bd7fe662337d1112e468a547e991c6be0e636bcecb8689816510534c8e479b447cc404ee711f
TLSH
T1DCE02BAEC922EC3705FE175860588347E74103272B40494F373C920C8FB1A37458587C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 720B
SHA256 e6d6e096e7ef9f0080e555247a15d0995857a2b76db20271c78765ba3e7094e9
MD5 51d4d79433786b27475abe6916e68693
SHA1 35e7d8e5cd31390ce0110da51c080912def05703
SHA512 557b2d10e698221ae0f388da5230d5d7827cd5e0e99579930e0b0c1085e1ccf79335aa74c72bb7d746e084b7f0473f2d9d8b4fb2ee27a86405016c21d7a89cb9
TLSH
T15D0184C0B081C7A1CB2C2A3E50C27B033139838B24DF8F3A8344E0B32025FAB60205B9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.triplekey.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

6684f045-3ead-478f-b44f-cefa3547e79e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6684f045-3ead-478f-b44f-cefa3547e79e.tmp
Size 10KB
SHA256 7e6b7468c0ca68571aafd11cc3ec30a50de569f7b39128d2ffd2eb1ce276bf2e
MD5 9813a7aaecf98434c40d11c4fb89df55
SHA1 0f56f899f5a3e16e58f9355c6ce6b80e8968ae0d
SHA512 c9f962881630f5faa28113e27a9f9d5fe9fda27a55bef5bc5c23d727426238bdfa523c4efa4ca816cb3c2dcdcaea295b0027563b568fe21410b2d706e07bcdf0
SSDEEP 192:DhIV29KQK1QaIaE7NTkiSVYGnjfQ0s4GuI+nHIhE1GneRV4HrY1QdtABcauTpY3L:DhIV29KQK1QaIaE7NTki8YGnrQ0s4Guz
TLSH
T11E226CF783F8CA6E99019AF49B146D27CE9D0514521C3E668CE8FE0BA7E3571E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e84e9e71-8e4a-47a0-9d9c-8697885fcfd8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e84e9e71-8e4a-47a0-9d9c-8697885fcfd8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 fa1bdd1cf75b1fa85ef9543dd40f1eb4014e3013889573fbf88d55ca5025000a
MD5 3bb8e49bb52b47601785d090f3b65b06
SHA1 8f53d88c2152aeb2c132c1d9aba8c2eb4e274630
SHA512 c572044520fec58f4b9b4b5389d72833f4e4185bda8dfef2d22ce8c6d02b7df2b6c13422f677e0b40ea35fde4af1a2e048d8a4db918280dd3594b79c2b9d98cc
TLSH
T1F6B0128480826711C40602F51E6014D87294DF20A605130142F01D15D83A660801B055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e580c50cc62dfc7fcebd4691ff263cbe1e8d6e8db06806f9183efc38ec0127e1
MD5 76128e7c6d3d34df41f52884fbcf1f6e
SHA1 782ae9243047e90942be7bb4712753a8f6ecb21f
SHA512 58e727aa9aa47f4be7e0a554e073f89ae9a51c8dc144bdf5c57ca66cfc3de45cd7f9507c2d231c9f3fbc7a8bb58da390154033484501e99126044ab3ce629967
TLSH
T117B0220CC0023282C08303B0388080E83230CF22C303032283F00EF2CC20BA00020030
MD5 SHA1 SHA512 TLSH

Submit Download

bac600b1-dbf0-4be1-87be-ebdc734dbebc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bac600b1-dbf0-4be1-87be-ebdc734dbebc.tmp
Size 12KB
SHA256 a1333adcaa699d8e283aba856f4e01b10b88faf635af83e967ced2f12b36ebf0
MD5 63976b75157ed44d15b5d3123c5ecf08
SHA1 dfd14910f77ef237cab158fc432aa5ffac49625c
SHA512 5e837b31407a7db8a9cff0a64b1571c7b5be43f14ce2c3c366280e5c3611ac28044d47f62cdcc8890b7df9b588586ba7a85a9d1de24d01543d83a6ca2453b0c1
SSDEEP 192:VRwHvr9yQDfDVv7MpAPRp24yO9tHsb+WNnpuhhMk23LPbkwq76VyIsnAUge:VRwHrlwUXLFvwUhl27Pble
TLSH
T11442A52EBD60353B5CDBD72AE9A5BB93D7F5202120942E44E7FC882C25E76CC2127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f18eea07-b45c-41ce-948e-c6a3897c71c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f18eea07-b45c-41ce-948e-c6a3897c71c9.tmp
Size 13KB
SHA256 70be95a7defeabed6bcfa44f0f4ca4f1d2b9b15db8da159a9b0cf26765b49024
MD5 45a5f359e30ef29c0cd96ea86d6c1c4b
SHA1 84d053ff7fcf28307ec7d8540825ce10fd990ae1
SHA512 d353e62e26cc9ec28b4174a33ca348d461718c5d2d20065614b0e1f19e4745e31e18534f0bc9012ff0ce77b1d5241c7a17d9fecaeb0ebc1e6c166525f124eb9f
SSDEEP 192:VRwHVr9yQDfDVv7Mp4PRpd4yO9tHsb+WNnpuhhMk2gLPbkwq7BVyIsnAUgE:VRwHtlwEXGFvwUhl2iPbGE
TLSH
T1FE52942EAD60393B9CDAD71AF9A5BB93D7F5202120A01E44E7FC892C25E76CC2127417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c990d2c9-fb5c-425e-b5c1-51a9c59404ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c990d2c9-fb5c-425e-b5c1-51a9c59404ec.tmp
Size 131KB
SHA256 6a4e830b4c8fce3dd5ebe3f1c40c4a92d450a7eb793f990ff925871566954629
MD5 375e258ebd3ae523b2bd91efee1e485f
SHA1 7e7202462067cd70ebb3878deabd9cf1f7858a37
SHA512 7176ba32c446f808ffccf3e2cf36f8c885d16692a03112b98af47da671733845e927b8c1b02dd9b4b97f8379ed3d77da4d85c4cc1f96bbb94589c6988e1d23f7
SSDEEP 3072:RIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:9Ptbmf1K49XLWbEPi4NTKlLzh
TLSH
T13DD312217D01BCB8A9AEDB22B1901A15E6B4DD4BD5397BE61CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec57df72-cb6a-4fd8-9b18-e65cedbe68ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ec57df72-cb6a-4fd8-9b18-e65cedbe68ed.tmp
Size 132KB
SHA256 3ae42d123c66c9a5c1de921998d5d5571210ebee31311a17cbdcc78fb70cc86a
MD5 fd958eea5098a6d65e738ad0036d895f
SHA1 02d7c9583b0e7d2139ab5ce7d90bd70d3100513d
SHA512 03f78b564692d84b8301ba81094ee9107d27d470c42e0a25893570e2be343e1cba3cc8e1ff04a7fccf5b771830c4ecfbefd6594a1ae8714cdf008ac2f06c59c9
SSDEEP 3072:1IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzh:RPtbmf1K49XLWbEPi4NTKlLzh
TLSH
T1B5D312213D05BCB4A9EEDB21A1901A16DAF8D94F953D3BE65CDE3F4806E3699C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download