hxxps://xoici7hbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&_email=mjohnson@serverless-solutions[.]com

Analysis

geolocation tags

eueuropefrfrance
max time kernel
149s
max time network
148s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
Sample261023-e4ppaahw6x

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	6	[email protected]	3872	chrome.exe
Email address	14	[email protected]	3872	chrome.exe	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3872	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
5080	chrome.exe
5080	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe
Token: SeShutdownPrivilege	4252	chrome.exe
Token: SeCreatePagefilePrivilege	4252	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4904	4252	chrome.exe	83
PID 4252 wrote to memory of 5644	4252	chrome.exe	84
PID 4252 wrote to memory of 5644	4252	chrome.exe	84
PID 4252 wrote to memory of 3872	4252	chrome.exe	85
PID 4252 wrote to memory of 3844	4252	chrome.exe	86
PID 4252 wrote to memory of 3844	4252	chrome.exe	86
PID 4252 wrote to memory of 888	4252	chrome.exe	87
PID 4252 wrote to memory of 888	4252	chrome.exe	87
PID 4252 wrote to memory of 6088	4252	chrome.exe	88
PID 4252 wrote to memory of 6088	4252	chrome.exe	88
PID 4252 wrote to memory of 4340	4252	chrome.exe	90
PID 4252 wrote to memory of 4340	4252	chrome.exe	90
PID 4252 wrote to memory of 5392	4252	chrome.exe	91
PID 4252 wrote to memory of 5392	4252	chrome.exe	91
PID 4252 wrote to memory of 4268	4252	chrome.exe	92
PID 4252 wrote to memory of 4268	4252	chrome.exe	92
PID 4252 wrote to memory of 1944	4252	chrome.exe	93
PID 4252 wrote to memory of 1944	4252	chrome.exe	93
PID 4252 wrote to memory of 236	4252	chrome.exe	98
PID 4252 wrote to memory of 4668	4252	chrome.exe	104
PID 4252 wrote to memory of 5480	4252	chrome.exe	105
PID 4252 wrote to memory of 3452	4252	chrome.exe	106
PID 4252 wrote to memory of 5080	4252	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff9b62cc728,0x7ff9b62cc734,0x7ff9b62cc740
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,1110903221428246973,9996920855725812581,262144 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,5244143595663403442,6488275918188554101,524288 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,18166681679096666614,1028599051172747604,524288 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,7503336912065693022,9621845425289065313,2097152 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,14448484003797367735,2338829939436257096,2097152 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,8579243245819176753,6402862206755011248,2097152 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4696,i,3662537503065215108,778114907118749236,2097152 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3304,i,14618009709714234866,11785209733089638312,2097152 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4596,i,17352513489316409160,17041488957108037483,2097152 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5100,i,17841788835742173368,1342486924535584443,524288 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,14870591693269099447,5401136462420669760,524288 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,16789714134614666356,11998384905813453351,524288 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,16603866070279459051,7813775671461315112,524288 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5492,i,8428155342034314428,6556173825897035984,262144 --field-trial-handle=2028,i,16242808366270394254,8533907794302296656,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4b9350ac-2359-4a74-8385-f737e57f53fb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4b9350ac-2359-4a74-8385-f737e57f53fb.tmp
Size 132KB
SHA256 b4997594924925ce34b69c3a76c1e01f90a6029aecd56faa1ec67524e3982573
MD5 f4c028cfa9706da7f093fed7d5c941d4
SHA1 89a4dfb9757b7b823758524d43fbdfe57dc5bfd8
SHA512 f550d637bfbe48f78676569144ea3a64b8d8c0b79ffbce445b072778e443e306f59f85159350d1eae0016b25967dedab53155cd28f55c644e44995fe91ea3fb5
SSDEEP 3072:jIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:LPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T1CCD312213D05BCB4A9DEDB21A1502A16EAF9D94F953D3BE55CDE3F8C0693699C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1666ae7b-61d6-4ebb-84df-e29d8665d68e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1666ae7b-61d6-4ebb-84df-e29d8665d68e.tmp
Size 17KB
SHA256 97bc66b4f155b0c7d1c1155ae8d3954a623213984f10f23f42e9e1fb19904a17
MD5 2be92c7643ba48fb4aa831b67bdf1af3
SHA1 79be648a0d33bdda874579b35bc4130d1a99c838
SHA512 807a577b54aae138829b44e4a6f8d45c0e84793dd9d5979325f6c50c10138ab57dbf6926083a46c29ed6ca492c7a21eb9c9bcc6ee1ce6172001f1ab91694f4d2
SSDEEP 384:KkjuF7KxkXqKf/pUZNCgVLH2HfgslxH7pLuLceSsNXODuF+ErU38jHGPQB7IYjL:KouF7KxkXqKf/pUZNCgVLH2HfgszH7p6
TLSH
T109721A67BC4C9E7B0F94C68CC8177E4FACB5025B65E9886482FA982603D5BCF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7eb53616-f64e-40d9-9443-b853d9164fe2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7eb53616-f64e-40d9-9443-b853d9164fe2.tmp
Size 414B
SHA256 c4c4cc73d4d1b5474f0b4968c2a4130f946f60f2c1cde75f33838a599098abe6
MD5 531388bbd319c16e35946107c387932a
SHA1 d76c1878de2c0b77ac7a260099e110cb89e30608
SHA512 65d3b5553eecd95bda01d08f264871bf4b03cf0cae53a0a08d01f83aad5bd623ae0f1b358341127a95e8bb2e0b8ed0d2bd16d1f951708437c396730aa06dbe81
TLSH
T1D7E02B5AC860EC2708FD472868910A45E606135726D19D4F7B3D811C8FF0636059682C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 696B
SHA256 cd919a7fed5ab23a6afdac3516c9202c853b76439fe2518eb3aed6f18cdf0d0a
MD5 7c0ada33ec59ebdf091c6f824862e8f9
SHA1 299736937292bb5f713402ef5ea5d20faab44702
SHA512 062c7dfc7afaf7b8e7594b2374faeb837b20358e1ccd0c17d4ab3b24b30f36f79a23dc88bba9cfd7c3f6acc8f69e16682bf360e9d38b20117fb92635b9b411e5
TLSH
T18F0152CAB0C26430EB5C7AB064D62D02B239A186319F0F57AEC094B72412FC764EE328
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.triplekey.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

1875b825-7b6e-4ecd-ae51-943174197f5b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1875b825-7b6e-4ecd-ae51-943174197f5b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

334da72b-e0c8-4907-a033-dbb8509cd1d8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\334da72b-e0c8-4907-a033-dbb8509cd1d8.tmp
Size 9KB
SHA256 52569fb2d988b4ed254a369729472896464a68e3fe933f474b1f848841f8de7c
MD5 2a1518af0cb84860c4e28fa685558e6b
SHA1 86ceac546aa74939add9d3ca1c981265c6b907e1
SHA512 7c8bf42cbe6847511e031697e02a48d13c01be09084cf32161e8a9690958f56c006bef016f6897dd1d11884e76b853445c22215905e3fdc8927a59ec742f68d0
SSDEEP 192:DSVdT1wLzQsCaaEdIYxCLYynjgQ42JIO4NNohZfmnh1oCz4S/XY1YFafB2+TgoYU:DSVdT1wLzQsCaaEdIYxCLYyn8Q42JIOv
TLSH
T13522AEF383F9C66E88059AF496146D27CE9D0518532C3D66CCE8FE1BA7E3571E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 c4cf1bdf21e0cd9f4ff1762f573b8c3523c9e48822b3837ff02b962d635f3046
MD5 abc02b085ac028b852ee26b42b3b7849
SHA1 1792364b8ffc1135e625c14a8297c1808c2abe9d
SHA512 a2e4e2783ba602481d609e2959d832c2dfde3f4bfd877cc9df46e65709f3c3e004bd07993c34440ecb43dcd1ffedb1c5896feb47f15b4fb261c9291d995a0bf3
TLSH
T1E2B012548041A351C40702F4225024883158DF11A6092381A1F40DA188399A0821F254
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 091ad2434766b1c6a5be0e3e292f84fe06bdf2d4d8baf01cb580473ca3bafaff
MD5 2895d891e701d8b5e84c94d4b4fac828
SHA1 744ef4213b2cea44473f2ad7dece73924d55526d
SHA512 0ee1edb2e1ddbf87f6aabd919c5c2ee42752e64f67f71f862c5367bb840ed7b33aeac2b75dd9c3c6e3f1e939840e01df8635777dc1a24d1ff554bdc9c1d569ae
TLSH
T18BB02200C0023222C02303B0288CA2CC3030CF20E2032B0283F00E33CC20B20802C330
MD5 SHA1 SHA512 TLSH

Submit Download

b470bf3b-963b-4d43-86b7-aa98d7c10c1f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b470bf3b-963b-4d43-86b7-aa98d7c10c1f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e8ed3bb0-2a1b-46f4-9487-6766327326a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e8ed3bb0-2a1b-46f4-9487-6766327326a6.tmp
Size 12KB
SHA256 d4990c78f373b0c441de519e73fd3a5fcba9b90b60afc128ab6f1148e3651e24
MD5 bdfb30469dd6d96d36f677eb84e95a8f
SHA1 b9ea5e858df32412da7b6666721e24fa31c34c26
SHA512 71e8efc6d14ffcd22d75495bee1084565c08bcce57efd0e1ee659b1c2870d1ae59c2fac9aabe9cd8480d208f6db4899b89bd53a6236963c78889297d687c3b6a
SSDEEP 192:ARAtvjZJPCWI8v7upAPRp2Jy89DHsb+WNneJhh7w2aSnHat2KVyIsnAUge:ARAt7ZRmoyUX6rdwchu25ke
TLSH
T1EF42B62DAD10797B5CDBD22AFA257B53E7F6103535942E80D6FC892C25E7ACC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 c5c2aaa925633821401aaf934a27673c17e0607ac78c11549d122c9c0bedaab9
MD5 fcf18459c70cd3aaf0ab42bb19755ad5
SHA1 9d8d1736af85c2eebe6e77428278459eab928ece
SHA512 9fd196294b15d9fa2296dfc6e2c28916a43103f025172e9c2e442099f5bcfc4efd1738cbac0c8421ab7c259b0cb71babcdeb57237a2162dbc5b9f8be1fe2713c
SSDEEP 3072:bIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:DPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T151D312217D01BCB8A9AEDB21A1901A15EAB8D94F953D3FE61CDE3F8C05A3699C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cadeeb82-f832-49e3-963e-73a9be0813e1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cadeeb82-f832-49e3-963e-73a9be0813e1.tmp
Size 132KB
SHA256 1ed25ccb07fee8dab394b2b0584129028da75159fbb2940fec4daac81735de56
MD5 3121d0b63668117137228b999cf2cf73
SHA1 f7dbce7ac5cbf954bcf2298017eb3025f5aedb21
SHA512 687b700bd536599981459936be71a1ba87fb5c66b41fb8f950729d017269db2c84c1d0559f4bc5610b2315289f04addfa08e0b9fea41fe3904fff59a352a3cf0
SSDEEP 3072:0IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:QPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T153D312213D05BCB4A9DEDB21A1501A16DAF9D94F953D3BE65CDE3F8C0693699C304C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d46aced0-68eb-4fc7-90ea-26a858a42039.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d46aced0-68eb-4fc7-90ea-26a858a42039.tmp
Size 132KB
SHA256 2f68d9977c3a28aef54c0fbedce7e31a919ae2b76b0cf2b6718022694932f6d1
MD5 ab8ddd13dfd588b062afd1286a21b299
SHA1 8078b69a7a68a0b1e15139a74729253fc1757b49
SHA512 ef02bf24f668c709b844417b3a414a208d8e7f675231179cf8d737e2c5080dace831630a3c96b2ff063dbe75cccf97fbf01f1c2d75fb0390be2c9abf857cbbef
SSDEEP 3072:IIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLz5:kPtbmf1K49XLWbEPi4NTKlLz5
TLSH
T1AAD312317D05BCB899EEEA21A1802A16D6B8D94B953D3BE55CDE3F8C05A36DDC304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download