hxxps://www[.]docusign[.]net/Signing/EmailStart[.]aspx?a=1a75da18-1bb3-8dac-8080-9dc8011cd6e9&etti=24&acct=99b9c6e5-ec17-404a-96b5-4fed50728c43&er=7c81889f-6473-86d2-8030-1ae7cb092aaa&ensd=OlmiHSbJ0eI9ZkG%252fXULDam6sX45QdA9fQpY2oz5WB39T%252fKjh%252bKhb0zhXFGfMw%252foN%252flNMJlvAtDznKpk%252bT8Zry%252fCAhW10qz3GqFcy4zt1%252bTv9vSkaIE1PHRpB43WmxZAxbab1%252f6EfwIJlCP2GUzFBx901hBWA2wGvDRksfbm8yK6TbjIifep6JQUy7Wcr23Ov

Analysis

max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.docusign.net/Signing/EmailStart.aspx?a=1a75da18-1bb3-8dac-8080-9dc8011cd6e9&etti=24&acct=99b9c6e5-ec17-404a-96b5-4fed50728c43&er=7c81889f-6473-86d2-8030-1ae7cb092aaa&ensd=OlmiHSbJ0eI9ZkG%252fXULDam6sX45QdA9fQpY2oz5WB39T%252fKjh%252bKhb0zhXFGfMw%252foN%252flNMJlvAtDznKpk%252bT8Zry%252fCAhW10qz3GqFcy4zt1%252bTv9vSkaIE1PHRpB43WmxZAxbab1%252f6EfwIJlCP2GUzFBx901hBWA2wGvDRksfbm8yK6TbjIifep6JQUy7Wcr23Ov
Sample260504-pgdzdaay41

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1008	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223707093983503"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
5308	chrome.exe
5308	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe
Token: SeShutdownPrivilege	4400	chrome.exe
Token: SeCreatePagefilePrivilege	4400	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe
4400	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4408	4400	chrome.exe	84
PID 4400 wrote to memory of 4188	4400	chrome.exe	85
PID 4400 wrote to memory of 4188	4400	chrome.exe	85
PID 4400 wrote to memory of 1008	4400	chrome.exe	86
PID 4400 wrote to memory of 1820	4400	chrome.exe	87
PID 4400 wrote to memory of 1820	4400	chrome.exe	87
PID 4400 wrote to memory of 3492	4400	chrome.exe	89
PID 4400 wrote to memory of 4308	4400	chrome.exe	90
PID 4400 wrote to memory of 3492	4400	chrome.exe	89
PID 4400 wrote to memory of 4308	4400	chrome.exe	90
PID 4400 wrote to memory of 3396	4400	chrome.exe	91
PID 4400 wrote to memory of 3396	4400	chrome.exe	91
PID 4400 wrote to memory of 4156	4400	chrome.exe	92
PID 4400 wrote to memory of 4156	4400	chrome.exe	92
PID 4400 wrote to memory of 460	4400	chrome.exe	93
PID 4400 wrote to memory of 5780	4400	chrome.exe	97
PID 4400 wrote to memory of 4940	4400	chrome.exe	98
PID 4400 wrote to memory of 3320	4400	chrome.exe	99
PID 4400 wrote to memory of 5308	4400	chrome.exe	106
PID 4400 wrote to memory of 4816	4400	chrome.exe	107
PID 4400 wrote to memory of 4816	4400	chrome.exe	107

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.docusign.net/Signing/EmailStart.aspx?a=1a75da18-1bb3-8dac-8080-9dc8011cd6e9&etti=24&acct=99b9c6e5-ec17-404a-96b5-4fed50728c43&er=7c81889f-6473-86d2-8030-1ae7cb092aaa&ensd=OlmiHSbJ0eI9ZkG%252fXULDam6sX45QdA9fQpY2oz5WB39T%252fKjh%252bKhb0zhXFGfMw%252foN%252flNMJlvAtDznKpk%252bT8Zry%252fCAhW10qz3GqFcy4zt1%252bTv9vSkaIE1PHRpB43WmxZAxbab1%252f6EfwIJlCP2GUzFBx901hBWA2wGvDRksfbm8yK6TbjIifep6JQUy7Wcr23Ov
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4827c728,0x7ffd4827c734,0x7ffd4827c740
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,10899098409107907042,15772208998510606633,262144 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,9370681876314864441,14640536867263082860,524288 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,11535306088797749211,9757452555493962021,524288 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,3722534664827370591,2650340392994252315,2097152 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,11103974349326951046,11684490523018541821,2097152 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4392,i,13494107065459717320,7953030799739040870,2097152 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,7497873654507456598,17044631013450817873,2097152 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,12739384387105203982,1728057815905051796,524288 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4872,i,1838239495731591667,12400147298097886789,524288 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,16809223266044550776,3096000159840692165,524288 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4916,i,13532921568807386651,5017837954488167275,524288 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3444,i,4828568442666557673,8412918848295417231,262144 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,562002656177170917,12454704815601554512,524288 --field-trial-handle=2016,i,5896422865617590453,14465635311335362658,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:4816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bc754ba3db5c6f74e818153649c7d1aa685ea606cdb3fb2880da1da6e2a6aaa1
MD5 cdbd4b87ea7ed9457cb8bf6df7b36db1
SHA1 b212e37f6912eaad42a227a9ae8c7fedb8f032f0
SHA512 56086cb5cec23727d0c578687e1fe113853a440911064126a7fd46df4e8b01dacfc7c6d0d1019e3a7c1466cf0d22ea61585f9ae9fd29c12d93a6142402c70863
TLSH
T16EE09BAAD821DC2B08FD072D54914795E76013972750495F773ED3088FB563B458B86C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 816B
SHA256 e3cd63328c0fb64c4940b1b2e6d32e6dc914615b52afd3b91a25da0746bc0d44
MD5 82f1c6148b4b072596bc26c8373026e5
SHA1 9a45d4b7f7b7994a8adf110ecc640b893ae5ab66
SHA512 009d8cafc6eb4a1f17e578bd9cfcf9b5916f7511fd8f96d90f0c1cb76fd8c4028d14ae44945920fe5cbee6bd8fc078049b3f08c4fb3d2d9fc9923702098fdf45
TLSH
T1BB01FF275DC20256EF650F3185B22E8F1772B566C6914783C394206AE5A3FE58EC2229
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_apps.docusign.com_0.indexeddb.leveldb\000003.log
Size 24KB
SHA256 fcd7aa07b887751a653a8e970d79754fe267c52eb27636567d093bd5d5d6c975
MD5 5a6948e93687c6ca169da05e0a70269f
SHA1 2fb4a830606577058172a7262112e564450ad27e
SHA512 80d1ad2716a0387ca8b40ad477569547105bd3256664dda38b1303957952c36786ed42727c227641a6a08b23a1d6c14865510acb61ee2356d651c94ec6d44505
SSDEEP 768:nuCI246w2N652+P2oA2mR2Z9I2+JFwi4im0sH:ud6wQ65/PTAHRAa5M
TLSH
T16AB2621939E8172AF2B75EBD1A67068064B6FEF8EC91C7589064264C4D20B90DC73F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_apps.docusign.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_apps.docusign.com_0.indexeddb.leveldb\LOG
Size 355B
SHA256 11a1ffd5422a2de731c03eca7da82ef5054e0faf71ce20f125801ed72802753c
MD5 e9b1b9e28fa90ff0c00b1b076c95065d
SHA1 cffd4f1edb5d15746db676ca175f546757575dd1
SHA512 28f79de0a020686db88ae8281bff1c5174a075172d8d9e32858f8c1bf1e1abe21a70045cd7a6ce8fe649f25252007fa6236020d163cd11e0b6e150ef38223bbe
TLSH
T1D1E0C07C45DCC93F24C480A627307B0FCBE2251DD7CCBF850F55E81871C9008A06D260
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_apps.docusign.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 64d3fa5113774d24943b5d732d28f8abd1490c8a981b2f115cd164d289a7e745
MD5 5ad96041cd9fbff3b444d176ca698fc1
SHA1 a2a1ad3d8f4f6c2465eaff0d7ebeb7a58fd51baa
SHA512 084435acd17c3c648570fba724db7172501e85a94656750cfcad7b2721a215cc36b400d2856eee0c92ee55a32f52c388f908a899f93b441ef07783f7152007f1
TLSH
T1B4618DF383F4996DC911A2F4AB256E2FCE690924131C3C66C9E4AE1B53E2872E10175E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dfff8675e8a1034694ec13662ed8d562086fe3fdaa7060bf38790742da007f20
MD5 aca330b6c6b91f3bbf1e51e1e688a391
SHA1 f43387c55516bb495f6da1ed8334281bc54b4996
SHA512 7862a01cd5cef748514eefb2cfe83bae01d3b45a5715867e47af18646aa4e756aa8814e0fbc614c0723c64fb2876b851fe3f442c3bfce6c16d2eac114f955df7
SSDEEP 192:lR43nOBqwTjGv7SpAPRp2xAJ9QHsb+WNTiXWID72fN2TsPkw89a3x0VyIsnAUge:lR43sqcyeUX3WwnA2wgPc9a2e
TLSH
T1B442E86EAA14357B4CDAD22AFE22775BE7F5102171D42E48E7FC8A2C14E76CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8cca9c8c895de43a1e7770a429de42300629e783ab7af514183f6b0614c41d29
MD5 1a2bec7fe9e23eef6711d1c1b5780e8b
SHA1 3a920c505ec487edf913819e47c3ad3f8601d8d2
SHA512 fab2a0f3b592be4231ce32ee15bb78ff62cef43a51d7c2b3c489da396d931c03671b1f4052806030dc6bbefda752102e2db25d9d6ada562309062b8ec3ea99b3
SSDEEP 192:lR438YbTjGv7SpAPRp2xAJ9QHsb+WNTiXWID727N2TsPkw89a3xqVyIsnAUgE:lR43RyeUX3WwnA2EgPc9aIE
TLSH
T1C452E82EAA54357B4DCAD22AFA22775BE7F5102171C41E48E7FC8A2C15E76CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 b6664493cc7f354e0d0f13cf223dbfd0ee087fdfcfd4eb7b90ba4c92fef1899c
MD5 1a74105b5ba9c7d42f2e74a8af064544
SHA1 309b81e1248b2f6bc6b270d22023b2cb03179cbf
SHA512 af2c099c13f5b6f2b3d6a6520cd29bac397b634a39d7e458b68e4a7b218ff919c96de2cc9cb5a51ba5fff2451e877694ff86832421798ff9ba3d0174c5588b56
SSDEEP 384:Qyjk37KxkXqKf/pUZNCgVLH2HfgslKD7pLuLcifSzXODk7+ErU3fFHGx3Od:QSk37KxkXqKf/pUZNCgVLH2Hfgs0D7pk
TLSH
T11F72F9A7784C9A770F94CACCDC167E4FADB5024B65E9886483FA982503D5BCF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2a781e0c58e5415baa08e1f71cc96ac7429ca05b\6cd828dd-8ec2-4951-8656-6ed5a48877aa\index-dir\the-real-index
Size 576B
SHA256 4f5bffdc10c795457197ed384a90ae63c1f2b0f406671e59946ec17532030c81
MD5 d2ad5c7879839c78756837043bc136ab
SHA1 d2b4dffa87874c2b1dbe3f911337a3f070af3fd7
SHA512 b1a191b3faad33c2c13735c814caf1fcf4690e71fc8d4f53a100648868058baaa01963147e18dbed633cf7cd029e3d7723ccab3c6d6bf88df841c61fec0c747f
TLSH
T182F0A388A01520A4CDD608FCD51560513FF9C63C0536D703D44240F1A5E508FAE8C9E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586a8c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2a781e0c58e5415baa08e1f71cc96ac7429ca05b\6cd828dd-8ec2-4951-8656-6ed5a48877aa\index-dir\the-real-index~RFe586a8c.TMP
Size 48B
SHA256 d8a6e4d17b4c7033aacf93646d6e23f65938cc8df8e1e93febd7a2b20d65bf52
MD5 b6ad7381de080e076fd917a433c8cd39
SHA1 ee9f3d5a0bd93257d0f4018d9b6d208a8f214cdf
SHA512 967e934d363427ab527f57f1f5620c60de3943aa2beb1e955473c2ae1503fcc61c9d5f4ea9256d16d402d53ffc536c9d85490d11feed6c4e709d205c9d274037
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2a781e0c58e5415baa08e1f71cc96ac7429ca05b\index.txt
Size 181B
SHA256 2625f4fc9d823499958658aba3f8e13dccfbf88767e860360e208c0a1006d822
MD5 ca5c0f143fcaa18e51007c131e593975
SHA1 a1c4ce81e7bbb313becdbd83aadc30feb1ee920d
SHA512 3cb07989c8cb32042789d59850965d6bc5988364672a2aa87e2e065d78c07d3ccfbb52914ea219b91af49d37760af9c9f99d128f994e9f9dc40a1d5464dae7db
TLSH
T19AC0807758915432EED0F5C41F431345C50761FB4DD3C5C00C4D94505604451155FF7F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586abb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\2a781e0c58e5415baa08e1f71cc96ac7429ca05b\index.txt~RFe586abb.TMP
Size 186B
SHA256 77acfd61bb5bff36f9dd68a59daab8b215969f04da8aae7b664999aa1c37bbc1
MD5 3711f0d76dc20c89fd5516063c30b967
SHA1 1d5ce78d38c6607e6183571743464b5215c64d35
SHA512 a948d85214240d622196d1461c22c8913865c95bf1a1dc661d35f28ff6815041304b79a21be8487054a1ebf0d4af534c05e068c494ef35e49d6735bf3f07d7a5
TLSH
T158C0127618A09432AFD0B4C45B421785850769FA4EC286C0084DB0405634412552FA6B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 e9ee0549b6d7439fa01109d27d279351eec81b2749f159e6bdc80cc9d94953ae
MD5 bbc524aa54a16bc6b0d653caf6835253
SHA1 89f8ff257437845bddbfc762956146b4d0c287b1
SHA512 029432f9ef8251d2f5ba67e1adc3c95dd19564e35077f68d9d2e6d2a907b9c2c06e051f60a9a9c6c862d7028f4bf48d1370a25bcb147554daafb0fb747fc3050
TLSH
T18FC01212CC0A6189C08603BD1893DCBC3B24EF74D61D174DA7E01D21BC357214229176
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585bd7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585bd7.TMP
Size 96B
SHA256 82f02186fa7d2b269afa30aa22d13fc90677ec456ea0929471cf4772a2a38b0c
MD5 5b9f188592e038b6e8c2d1352900d6aa
SHA1 bff699acbbbee9e563412aa3681fd925054e6967
SHA512 501c5d0fe5e88aa5d3256ae164c12c914e74fbb763c817396bacf1504c48153c02322c50cbfb59782b18ed18f48d717637715703a6c1eb7789b6ea5cad069492
TLSH
T145B02280C2023202E00203F022C080C83020CF32CAC3022282F82A22CC302320838220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 860473217da0f4bcc0a76cf7dee4116d7315331b5aa0dcdb9b204a6d451daae5
MD5 4d27a3c053cabd7e2ea0a9cde244295c
SHA1 c9faf7ab3653e40eb2bdb5276624f40c3dd81fa4
SHA512 4be59eb631cef6dda2dae53b4dc8bab0ca762b1ba10ae6fc9eed65696f1204e3ffc4caa6e76b05b97497858b72fc5515eaca176cccb69301730e43e043ec3929
SSDEEP 1536:03tV7cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR97:a773Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1559302BA5E1605F799BE5A9276AE7909CE12130E705F68CCB16C538C20D41CD3B63E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 9ba432c2c8a4112f643ef5d80f113ccde08b096cd2c7f7630dc7ab46cc35b344
MD5 b35816b3cda12cec781131ea193a819e
SHA1 7f3f5eaed7ce0bb2af4d232ca2bc3dd19a98407f
SHA512 87924771d3cb72c54c83d2cf9cef92ae20900889eb8c09444bbcb85bd98182a92c61bbac0a80a93edaca77aa1aa134f8f1fb13265b9a5ce9a5951de97059c43e
SSDEEP 1536:E3tV7cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR97:q773Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1069302BA5E2615F789BE5A92766E7909CE12130E705FA8CCB15C538C20D41CD3B63E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 d738b127bed8827f5224fba954e415ff1c00ccc33c8755f3738354c80498bc2b
MD5 e4f9abacd7d2e7da8555997f71146109
SHA1 c60f19ca8c68cd6be4ae13b0d28fae850868699e
SHA512 7c0a89a06ee071295d566e4a09ae66af77186bfff0a23de59c70e85b99d0e829d91455dad2f1e57d9c678bdabf49e314c7641eb002edda0b2534ce2b15cff2e4
SSDEEP 1536:v3tGcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YO:/A3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1559312BA5E1646F795BA46D176AE780ACE12130E305FA9CC72AC138C61C51CD2B63F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 6d05ada33b9040609875a71dcaf60c1ff010fc08034fd108bca370255bd61d06
MD5 964c770f367272437f9528776a5f9aba
SHA1 7abd55d83be51aa90505f737c2bcd86761f26b55
SHA512 c908e96276f2f00b45ad255ff03aae645acc08e1a34b672cab121175a53de7a4a7c8199e92a2daed029b33d73dbe44a539bdee33c2fad5e271d4bb0d0e0dc150
SSDEEP 1536:s3jXrhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jRh:Snh3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1769312BA5F2646E7957D4AC136AE7908CE12130D70AFA9CC726C638C61D41CD2B63E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 185a34873f34a4723e9fb9b82c9540b3b1cb9bff134bc95b104a21878733573c
MD5 aaa3066e1d768cea5fd137aa640439a6
SHA1 817aadd1235dc09b60b81f815396922df880985d
SHA512 942f1100204799c47870b47c0cc159428835ea2d97c31f38afccffe00a5d3be30abc920867a8b48ed75a2fb69f4b9a84d5d42ec626f5c622855922daa01fd2bc
SSDEEP 1536:E3tGcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YO:qA3Qw/xLANk0mUW5GmRntSFCjEEND
TLSH
T1229312BA5E1646F795BA46D1766E780ACE12130E305FA9CC72AC138C61C51CD2B63F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download