hxxps://xoici7hbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&_email=mjohnson@serverless-solutions[.]com

Analysis

geolocation tags

eueuropefrfrance
user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
Sample261023-e4ppaahw6x

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	7	[email protected]	5080	chrome.exe
Email address	13	[email protected]	5080	chrome.exe	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5080	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
952	chrome.exe
952	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe
Token: SeShutdownPrivilege	5236	chrome.exe
Token: SeCreatePagefilePrivilege	5236	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe
5236	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 2128	5236	chrome.exe	88
PID 5236 wrote to memory of 5080	5236	chrome.exe	89
PID 5236 wrote to memory of 3060	5236	chrome.exe	91
PID 5236 wrote to memory of 3060	5236	chrome.exe	91
PID 5236 wrote to memory of 3672	5236	chrome.exe	90
PID 5236 wrote to memory of 3672	5236	chrome.exe	90
PID 5236 wrote to memory of 3036	5236	chrome.exe	93
PID 5236 wrote to memory of 3036	5236	chrome.exe	93
PID 5236 wrote to memory of 364	5236	chrome.exe	94
PID 5236 wrote to memory of 364	5236	chrome.exe	94
PID 5236 wrote to memory of 5100	5236	chrome.exe	95
PID 5236 wrote to memory of 5100	5236	chrome.exe	95
PID 5236 wrote to memory of 3504	5236	chrome.exe	96
PID 5236 wrote to memory of 3504	5236	chrome.exe	96
PID 5236 wrote to memory of 3360	5236	chrome.exe	97
PID 5236 wrote to memory of 3360	5236	chrome.exe	97
PID 5236 wrote to memory of 4884	5236	chrome.exe	98
PID 5236 wrote to memory of 4884	5236	chrome.exe	98
PID 5236 wrote to memory of 4300	5236	chrome.exe	103
PID 5236 wrote to memory of 4132	5236	chrome.exe	111
PID 5236 wrote to memory of 4812	5236	chrome.exe	112
PID 5236 wrote to memory of 1232	5236	chrome.exe	113
PID 5236 wrote to memory of 952	5236	chrome.exe	115

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9643cc728,0x7ff9643cc734,0x7ff9643cc740
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1556,i,217675504620632045,3918508768415334238,524288 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,13477609552912004447,1725838803699673484,262144 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2252,i,7670287344212570807,75900177901871337,524288 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,4448524244644049289,13385062599634665249,2097152 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,15252905624773514942,12884767201084011581,2097152 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4140,i,3719298997691854736,17557176080893170589,2097152 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4156 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4648,i,7851199718099249068,277846344836697700,2097152 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4880,i,16564646082775938959,13786476038357331043,2097152 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5044,i,4385590500783576612,12872762423044595487,2097152 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,11911625210255968002,8297391959452320915,524288 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6316,i,15688685776188871207,4474990827691666834,524288 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,4689391156338602495,789513366203313503,524288 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,4839793201901824587,16900560097751936124,524288 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=728,i,17031883481398394367,4000668536841613921,262144 --field-trial-handle=2088,i,10871536566132360319,14622619677743101844,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1a2fdd66-c13a-4699-8f0b-7edaf05cc4d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1a2fdd66-c13a-4699-8f0b-7edaf05cc4d0.tmp
Size 131KB
SHA256 6d9fe582d8ce1d67244138ed214415ba593d1878c790fb97eefdf99899ebbd70
MD5 50e036735677509652957a6fa6f37902
SHA1 91477ff329036b63682074799b1734117a4fd6a4
SHA512 8ac655c8123b562d5cf4acc28cefb5373e73ee6106b45445ead742a3c5ac2573a807e128ac785235e587a01ed6554ef531235ca4d92998972ff90480806378a3
SSDEEP 3072:ErE/+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Era+hFD+7t56OD9ZfSApprB
TLSH
T1BBD31232AA95D877C9FC6141A187A300CE76ACED45DE3A09444A5FCED09F94D07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ca93e2e-0ced-491d-bd14-7490cb186082.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4ca93e2e-0ced-491d-bd14-7490cb186082.tmp
Size 130KB
SHA256 9d7e905419a87d2ff390ac8cee8f3c4b808fbf6e799c5b3afd61a51e6e4625b3
MD5 70a37d2c4a864aeff15dac5253632caf
SHA1 2ccaddb4ba25a65c07bb893673c6ed245aadfeee
SHA512 0e06c5f47448a9d3e5df88ee951f247a89e8fc62fc0af044bbdf51dec7cbe0bbce337ba6a62ed583572ff0b9f81e46a4c7a0c979e62f6f5d627975ed55a4e2e9
SSDEEP 3072:Uz+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:Uz+hFD+7t56OD9ZfSApprB
TLSH
T18FD31232AA91D8BBC9BC6141B157A300DE76ACED45DE3A09444A5F8EE05FD4C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5493c041-bdf1-4d3b-ab73-ed5bb1bae3a5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5493c041-bdf1-4d3b-ab73-ed5bb1bae3a5.tmp
Size 131KB
SHA256 a52987798b7c85d1410126ff51519169b4c41fe852ed1375cfb33d37ceebd4b9
MD5 d4fb5bee33e28a3072f255b761f1e870
SHA1 6350314c19618a8bad661c809cc9eccab54dd9f6
SHA512 c059a3d53746f17c24b2962626432cdf0eb3495feee3f4defb7b7a2afb965ae5ea6eb90d6831f5d4c32c5914aafd50773ff42522b3bdedb6fd6b073f38fb9b34
SSDEEP 3072:nrE/+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:nra+hFD+7t56OD9ZfSApprB
TLSH
T17AD31232AA95D877C9FC6141A187A300CE76ACED45DE3A09444A5F8ED09F94D07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d9bf84d-8310-4f7f-b381-40d885f24883.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9d9bf84d-8310-4f7f-b381-40d885f24883.tmp
Size 131KB
SHA256 6d309b76637639afdcc784e5285123f4f3b23f7a267fd9351baf8ba126e6eb50
MD5 00ab766c83a89d63f43b05e6f028c48e
SHA1 a492055127d1cf9d80f2f61fc54d74ff93a7fa16
SHA512 4397b31ca455fb815b1e3d69cf8d3b0f3a59af1c8e60c638806b6785bad9bfaef5f53996fb35acc0e65c38a6e4bea8dd244e72fa6aa11b5c65ca883d67a5fecb
SSDEEP 3072:nrEDb+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:nr8b+hFD+7t56OD9ZfSApprB
TLSH
T1BED30232AA95D8B7C9FC7541E147A300CD766CED85DE3A09844A5F8E909F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a421273-86e6-4274-9144-e21001a4934c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1a421273-86e6-4274-9144-e21001a4934c.tmp
Size 12KB
SHA256 94ed62c98c3ac9cea942cec27a0154ea2538ebcf5ae2d1f9390ca2b356ea3da0
MD5 d67d6df60e0b4c05a5981c9e52dc48fc
SHA1 86445152bc9805b4c8c362a3d887b904a1f4a99e
SHA512 a4e7633d70b8b435a208796467422bb26ae7a3bfae3ca361257c0e34df84a7550f1c2b10db39298dfed0854c5d12384ffb6e433e22374c6c1b60addbf23aa88b
SSDEEP 192:hRP/DvlLM8cpv7GpAPRp2/ys96Hsb+WNnrWhhlR2u42UR9enjiVyIsnAUge:hRP/DNSpCUX4/swqh12P2UR0me
TLSH
T1CF42A42EBE14693B5CDBD229FE617767D7F6102624942E80E6FC883C15E76CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ae211cf-6016-42df-a7c1-8c45e300004b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5ae211cf-6016-42df-a7c1-8c45e300004b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

70167658-eeb2-4f16-8a6d-e3fb337abed2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\70167658-eeb2-4f16-8a6d-e3fb337abed2.tmp
Size 414B
SHA256 333671fc36c35f5c9427b1f8196eaffad3a8a4f5d691634a55bd77912fe6819d
MD5 23563c5058a000f12108764191fa24d7
SHA1 097e166fb2c08415dd5456f2f2b13b5fe238c28f
SHA512 10db39a79268b1674b20338c1ef0411b92bc644f33b2eb8b7c41e1f0b04e196383795d2819d2caadba13acab143c8c6a833d8e1d629bda5ed882ef359d6338f9
TLSH
T1EFE02BF6DC25BC3B1DFDAB2E50108B87EB5613673680894B7A3C9209CF74A3A028585C
MD5 SHA1 SHA512 TLSH

Submit Download

871bbec8-7d64-48f7-8885-b9fa4ffbc451.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\871bbec8-7d64-48f7-8885-b9fa4ffbc451.tmp
Size 12KB
SHA256 317613bc283d92182ce92e7d169bd77262df3134e1ffa357c93df6bdba0fb230
MD5 5d618452d2d96f1b669f3204d8ba414b
SHA1 b1d1bd5db1973d37f04e27c2f667d04a1a36d21a
SHA512 05d20f0ba7296edc08872567a07fca271a68ea1c844ff417efed818607f28ef843c2a02a6ead2db82499b179e9a8669d468c43b1a009b34a2db6db71a76a861d
SSDEEP 192:hRP/DvlLM8cBv7GpAPRp2/ys96Hsb+WNnrWhhlR2542UR9enjdVyIsnAUgE:hRP/DNSRCUX4/swqh12O2UR0PE
TLSH
T10542B52EBD10793B5CDBD229FA617B67E7F6102624902E40E6FC893C11E76CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 696B
SHA256 5ea8b3035f893d1fac10c43c857d9dc52a15d1e792bc354e917c042e30885be2
MD5 ee3ce1fa45a2f7829c5445cd028709b9
SHA1 26024452d72d699fd24ecf55ac0c970743ce7279
SHA512 f69420b9ee498b2b0257c59ce4c8bf9c8cd94b992f85608f6f5efe29b2ad5fc5621d40b1da60cbd2ec985b34d115952b89b9549764848f9cbe2cb5a1133a52d2
TLSH
T110012EC6B0B204F6F70C3573ECC109903239C00AABBB2FA2BAB884B5E486FC8001C425
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.triplekey.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

7f7eb554-7a0b-46d3-a2cb-61a3c9bb5959.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7f7eb554-7a0b-46d3-a2cb-61a3c9bb5959.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a506bfe8-41a3-45a9-bab1-0ff49b58ca59.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a506bfe8-41a3-45a9-bab1-0ff49b58ca59.tmp
Size 9KB
SHA256 17755d65ce9a33da96b3b6761111402bcb280af9288b42c996a5b0c51cbd4522
MD5 ce58d3c25b8fd4085a521946de92757a
SHA1 3e2dcd9f55739c775325906d494efde98bdf602c
SHA512 d3f8772a8b8154fed3fb80a81b6882a271e35eed048422f5c153ffd563b68dfa33c50be9b48b384915c8e5c2f3a3cba7e57b43aa5aff769585d9c5e37cb39ee7
SSDEEP 192:Dl9V0GhyPQDEaIaEdLB1/YHnj4QmBRIfN4GYh+m4SE1cgY1xS1zuB+mTcY33aBE5:Dl9V0GhyPQDEaIaEdLB1/YHncQmBRIf6
TLSH
T1C3229EF383F8CA6E98059AF45A156D27CE9C0518522C3D66CCE8FE1BA7E3571E20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 2d3eecb8a5e6282189e453de0748620df7e476a817539f09cab41db0f694017f
MD5 ef82882193c79a5a0f285907f1aa5c0b
SHA1 b2fea877066f8186241931f9d26a963665d7d148
SHA512 7831f31d45f83e9ba7aa6b99b0557cc6db858e418d63faf29318f858293512824f1b9fe35e9aba5cce7f2937d38057088d8ed97b590a6f7c271f1ea5228f4675
TLSH
T110B0120580412711C10103701151905836708F34D112238645E05D119C352A0606F108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 3eb035f9dec2a8fa61845900515860eb038a7b3f6f8340979cf10ad8eab11c10
MD5 ff47414f558a957027ca896a0843f963
SHA1 88a92b2fab7b618d0da539c725864e113d590d0d
SHA512 fe907e17da3acdc4e92141b090ceb5959d6c2fea33b322e495319c4715cfe3d9b061098a3c1cca95514099df16b1603332e19cfafc9be285efcd19f4c632cc25
TLSH
T156B00296C1526312C14703B13599D5DC71A4EF29DA031216A6E01FB6EC65A71493A370
MD5 SHA1 SHA512 TLSH

Submit Download

e1a4ea94-45a9-4805-b616-d7cfec0b181d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e1a4ea94-45a9-4805-b616-d7cfec0b181d.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download