hxxps://xoici7hbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&_email=mjohnson@serverless-solutions[.]com

Analysis

geolocation tags

eueuropefrfrance
max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
Sample261023-e4ppaahw6x

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	7	[email protected]	6132	chrome.exe
Email address	9	[email protected]	6132	chrome.exe	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6132	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
4460	chrome.exe
4460	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe
Token: SeShutdownPrivilege	5300	chrome.exe
Token: SeCreatePagefilePrivilege	5300	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe
5300	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5300 wrote to memory of 2596	5300	chrome.exe	89
PID 5300 wrote to memory of 3452	5300	chrome.exe	90
PID 5300 wrote to memory of 3452	5300	chrome.exe	90
PID 5300 wrote to memory of 6132	5300	chrome.exe	91
PID 5300 wrote to memory of 1480	5300	chrome.exe	92
PID 5300 wrote to memory of 1480	5300	chrome.exe	92
PID 5300 wrote to memory of 1372	5300	chrome.exe	94
PID 5300 wrote to memory of 1372	5300	chrome.exe	94
PID 5300 wrote to memory of 4768	5300	chrome.exe	95
PID 5300 wrote to memory of 4768	5300	chrome.exe	95
PID 5300 wrote to memory of 2436	5300	chrome.exe	96
PID 5300 wrote to memory of 2436	5300	chrome.exe	96
PID 5300 wrote to memory of 3476	5300	chrome.exe	97
PID 5300 wrote to memory of 3476	5300	chrome.exe	97
PID 5300 wrote to memory of 3964	5300	chrome.exe	98
PID 5300 wrote to memory of 3964	5300	chrome.exe	98
PID 5300 wrote to memory of 1620	5300	chrome.exe	99
PID 5300 wrote to memory of 3172	5300	chrome.exe	100
PID 5300 wrote to memory of 3172	5300	chrome.exe	100
PID 5300 wrote to memory of 2264	5300	chrome.exe	101
PID 5300 wrote to memory of 2264	5300	chrome.exe	101
PID 5300 wrote to memory of 5976	5300	chrome.exe	105
PID 5300 wrote to memory of 5976	5300	chrome.exe	105
PID 5300 wrote to memory of 4892	5300	chrome.exe	106
PID 5300 wrote to memory of 4892	5300	chrome.exe	106
PID 5300 wrote to memory of 556	5300	chrome.exe	107
PID 5300 wrote to memory of 556	5300	chrome.exe	107
PID 5300 wrote to memory of 2344	5300	chrome.exe	108
PID 5300 wrote to memory of 2344	5300	chrome.exe	108
PID 5300 wrote to memory of 1964	5300	chrome.exe	109
PID 5300 wrote to memory of 1964	5300	chrome.exe	109
PID 5300 wrote to memory of 3336	5300	chrome.exe	111
PID 5300 wrote to memory of 6060	5300	chrome.exe	112
PID 5300 wrote to memory of 1452	5300	chrome.exe	113
PID 5300 wrote to memory of 4460	5300	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQo3iGEXovioSLCOhtO1Pty1iLXCc5lymVJaLEg8RODQ3&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffca6f6c728,0x7ffca6f6c734,0x7ffca6f6c740
  2⤵
  PID:2596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,6322684791035782907,6967076913960760613,262144 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,1650132616993240398,8169379834540181781,524288 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,12122684057240824736,14036518272978981879,524288 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,1542228238401013852,1517238670945307273,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3144,i,9975370044441516276,6467633031198869671,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,11341842374371546422,4550488241383521938,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4836,i,8315541888459839067,3028760197141693709,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4968,i,9125189304214554906,4235700894624197542,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,5539959702264354915,8689492268932294049,524288 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5928,i,12853227139599702715,1746165621642190641,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5884,i,11188254565099209374,8670615749529671174,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6240,i,14373214110756626424,15346692757500196079,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5920,i,11248292098433110762,1139668517361084813,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6196,i,15802305120545960074,13449046132394683029,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5948,i,3773175655733980339,4156689759391798067,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5964,i,6509809599792437910,17130885723947280471,2097152 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,7990887228660948290,9500393363810790220,524288 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6428,i,4416402003082090913,139492249807864729,524288 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:6060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,13830981074122695954,10538723628029240035,524288 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6268,i,12920994572788599263,1673772037182809706,262144 --field-trial-handle=1928,i,9708358863767349785,10484459394134924266,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3e8f38da-2d67-4fc7-b30b-3e6ebca95b0f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3e8f38da-2d67-4fc7-b30b-3e6ebca95b0f.tmp
Size 5KB
SHA256 92c5004e5b9aa253fd7b9b65761f0ea6ecaec8bed42a1399ceb158ef1f490720
MD5 2aea17b870ca53b2c9241a806c84f94d
SHA1 d9bfab38e56166c7d03e04461783ba629892b560
SHA512 dd582e05b22a0f942f3c7345037cd10b93fe78df1a38efd36ff3cb66311e751434b9e20548c2644495457966a15b82e51b5f6b2b520713fa12e1afee6d37e33b
SSDEEP 96:4lbJ0d+U7D/u1i5WFtfvuvAjWSl8h4otop5UqDoB6eGyvutKzkUWaaORNC39ISyD:gt0z7q134vPiU2hcK7K4UWaaOuCDM8
TLSH
T1A7C1F870986D987B8DF6E445B1032E43CDB422AF6814BE18E9E91E4C02D76ED1383A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46f8c111-ad16-4eab-ae5e-f50d35eb59dc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\46f8c111-ad16-4eab-ae5e-f50d35eb59dc.tmp
Size 4KB
SHA256 385b14af76fbf336251007c3f464cea7f9cd49c0ab514ff40a189c894ac83a10
MD5 8abf97ac1c9d6cf247c694b47f581449
SHA1 5d349708f4d0dcd2a9dbbbdab81a2d5129da7ce1
SHA512 12975c994857ecb47253ad575d3e70abac97cbb61669b3889150ba58fedabb592998d6bcc3920a0f0d014715d2b8f3d80ff1a9cd0397bba40c9dc29adba7d4bc
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5UHDoB6jGyvutFDLambYLsv4a:pC0z7q134vtDUDicf7FDLambY6
TLSH
T150A12C71E8BC99778476C485F5426A43CEB022BFA901BF84D8DD1B1C11EB2EC1312937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fd027b7-0fc8-431a-a13c-125bfcb5f425.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8fd027b7-0fc8-431a-a13c-125bfcb5f425.tmp
Size 5KB
SHA256 4fba0684d2d1a537e1816739acd9e7da30d5b7ea6daa4e21cd9861c420a9171c
MD5 29480c70759d959e1551cd19207dd916
SHA1 721288904fe5ca965e4a5a02249722b18cab29b2
SHA512 ab918d027da7c8a56c19f566b4c47e61c3814592f1a023244ff7d316a7497800e507878280b2b7a89f55582e21ebcc4222d3d9c781ebf09dce5ad1718db538af
SSDEEP 96:4lC0d+U7D/u1i5WFtfvuvAjWSl8h4otop5UqDoB6eGyvutKRevO0Ao5zUAaar0jU:gC0z7q134vPiU2hcK7KR21UAaarULi
TLSH
T149C11A70A8AD687749E6D485F1035A47CEF062EB6801AE50DDE90F1D01D76EC234393B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0bd4f97a-8430-40f6-9e49-8983b29024f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0bd4f97a-8430-40f6-9e49-8983b29024f8.tmp
Size 11KB
SHA256 61abad0b9ab114a83375fba12357383f0f44f5a04f064051f660c3b759e7ff35
MD5 ccc952b560b4c98ab5765662578e33ba
SHA1 ef2e23b8fe46fb30215fd6971284c9142442448a
SHA512 4eafe8851407d21272dd2a634f7350b1cd5cf2126cbedb8d74ffcada3d56fa8feddb3decff3d35a4e5e06066422427d4966f6e3319faecca9759402da6fbe98a
SSDEEP 192:eYX4K64y7KxkXqK4I40pUZNCgVLHrKHfFKslE2gOXzKD/XW+ErUkKN9cXcYxSgLu:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOe
TLSH
T1E932EA17A48D9E3F0FE8E51DCC426F8B7CB5016227784D24A2FB5C0803A97CA115A6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5367fbdf-2ce6-44e1-99ae-94da06e33d57.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5367fbdf-2ce6-44e1-99ae-94da06e33d57.tmp
Size 414B
SHA256 c150284c0a271296b1f6175459cc4235867e6aa67a80cd822a4e179524327067
MD5 95dcfb6d3cbc3443298ae46043305ee6
SHA1 f9e38c902692f42b63da1d0bf98f5e63ffa27a90
SHA512 5c3672bc5b364becfbeef28de404983d0b4aa2e4ef58ff39ea8917d757a3194595ed7ee6458da0fe04856bc3a5984b440381d1b3411f00feb80b0458d3101ce8
TLSH
T149E022A9C930EC2B19FC5B18A4644242FB16079B2A904B4B363DC21C8FB962E459782C
MD5 SHA1 SHA512 TLSH

Submit Download

6085c1bc-f6b8-4fa2-8619-cee20d9010ef.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6085c1bc-f6b8-4fa2-8619-cee20d9010ef.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8c7b24d9-d272-474e-bea2-2d072f4a7f30.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8c7b24d9-d272-474e-bea2-2d072f4a7f30.tmp
Size 12KB
SHA256 9c560c48673e19cac9cd10c96fa6a960cc3614e6acf107306fe56ea0b411a4c5
MD5 3ec96430e44ea997a739437cc379cd2c
SHA1 d20218820ecf15beaa29c61d66703b103164dd6e
SHA512 57449e343083ab014c4f959151b001d04c85b2400308b1d2b0af1c9812c277d9e453e5d8565cad7e613ef6089c99d89631b55d663ab22bf8ee47e02b438913df
SSDEEP 192:SRo7Anl2v7AvqPRpIYyt9THsb+WNnJshh4H2tpP9MkwIGPVyIsnAUgE:SRoklCs0XZS9wChS2tF9M/E
TLSH
T18942942AAD60753F9CDBC229F9217B13E2F6103165912F84E7FC896C26E76DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 696B
SHA256 0606b4b9449333de294df91612ef27d9444a9184bd5409e87d6621f403b66170
MD5 4ea55a4d51e388b57338bc7a83e49d92
SHA1 083327b50ac167eae0ee4ae1ea4af66fe3d474cf
SHA512 a6555746a4aaf7d880a5a0b481cf3ae176b03c9c1779d281ceaaa76e7e1bc9d8647670edd7d14c1364264e74b6d734b1cefe14aafd404e6670d0e22cf7c8ca1b
TLSH
T152012EC1BCA30730EBCC39325DC108003239934A2FFB0B0372A49CB28466FD5682E26A
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.triplekey.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

34b15f4f-ae86-431a-a905-94ad61428c09.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\34b15f4f-ae86-431a-a905-94ad61428c09.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a56dbbcb-42be-42f6-ae4b-469919d9ff96.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a56dbbcb-42be-42f6-ae4b-469919d9ff96.tmp
Size 9KB
SHA256 aa4dd5f24e184d6d0e54bf9ab8162e1aa97edd7417a9bebe7389861eb75b9611
MD5 7b4ae3e4dc663c58e6877f6fae22114b
SHA1 cddade1022389dfde56e0ac2108a9eb6f9ac3afe
SHA512 4529209c28039aea6a4ad56500a7e23fdd1587d702f93e097a94bf40d724b91d795d8b019707d0bc67b24c9436be9a18c214b895d0604977c377fb24ec30b216
SSDEEP 192:DlIVKG1eCQKN0saIaE24rYenjQQdF7IO4GqAAShE14jmLYGVGQtY0BJTNY3waNxG:DlIVKG1eCQKqsaIaE24rYen0QdF7IO4F
TLSH
T1E3129FF383F8C66E880596F46A146D37CE9D0518521C3E66CCE8FE0BA7E3571E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bde9cb4d-30de-422e-95f3-0c861713cd5b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bde9cb4d-30de-422e-95f3-0c861713cd5b.tmp
Size 11KB
SHA256 54858d6224b3fe183d7696e2b8c89e9d8d59b6fdc707e17a41c0b3cee4d475f0
MD5 a4028c993438153a1e82dd2088854236
SHA1 b4cdea412f59220f7d772dd83a31844b936114d3
SHA512 83d490f828df61c5deec1dcf14f6a3dbc2491e9d0b6ad902d749fbcf763796977a4063888cff1882829802a26ea97b72b51a7593be5afac32d0423cf08d16e96
SSDEEP 192:SRo7Anl2v7AvAPRp2Yyt9THsb+WNnJshh4H2bP9MkwIG2VyIsnAUge:SRoklCs6XLS9wChS2r9M4e
TLSH
T19542A32AAE60753F9CDBC229F9217713E2F6103165912F84E6FC886C22E76DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c583f477-8d79-4645-ba3a-6b44dcc01686.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c583f477-8d79-4645-ba3a-6b44dcc01686.tmp
Size 5KB
SHA256 2233709bf12a3fe4ea10320269ae8bbf2c1ec45fe6478225978d037161993885
MD5 30c967eb96af447daad7822d1f3facf2
SHA1 d4341b6b2c69541ef58baa7e7cf86a61e8659137
SHA512 05d35529c44b8cd27632b6be0ea94998468617dd0dae03e80380c8948200f8f5bd73c6a2447cd68f1981fcfe23ba173ee6d2da2c472027607a33dda00baea44b
SSDEEP 96:4lbJ0d+U7D/u1i5WFtfvuvAjWSl8h4otop5UqDoB6eGyvutKRevO0Ao5zUAaar0w:gt0z7q134vPiU2hcK7KR21UAaarULi
TLSH
T140C11A70A8AD687785E6E485F1036A47CEF062EB6805AE50D9E90F1D01D76EC2342937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download