hxxps://www[.]msn[.]com/en-us/sports/soccer/fifa_world_cup/game-center/sp-id-53452565?ocid=winp2fptaskbarent&uxmode=ruby&cvid=9c90fefc91914225adfc8b5f8b18fd26&cvpid=6a453eb667b148ccaa2d0a6ea02d9882&ei=8

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.msn.com/en-us/sports/soccer/fifa_world_cup/game-center/sp-id-53452565?ocid=winp2fptaskbarent&uxmode=ruby&cvid=9c90fefc91914225adfc8b5f8b18fd26&cvpid=6a453eb667b148ccaa2d0a6ea02d9882&ei=8
Sample260701-xfe42set7x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1728	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274052622554125"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4820	chrome.exe
4820	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 856	4940	chrome.exe	84
PID 4940 wrote to memory of 1728	4940	chrome.exe	85
PID 4940 wrote to memory of 4600	4940	chrome.exe	86
PID 4940 wrote to memory of 4600	4940	chrome.exe	86
PID 4940 wrote to memory of 1684	4940	chrome.exe	88
PID 4940 wrote to memory of 1684	4940	chrome.exe	88
PID 4940 wrote to memory of 2872	4940	chrome.exe	89
PID 4940 wrote to memory of 2424	4940	chrome.exe	90
PID 4940 wrote to memory of 2872	4940	chrome.exe	89
PID 4940 wrote to memory of 2424	4940	chrome.exe	90
PID 4940 wrote to memory of 1936	4940	chrome.exe	91
PID 4940 wrote to memory of 1936	4940	chrome.exe	91
PID 4940 wrote to memory of 1168	4940	chrome.exe	92
PID 4940 wrote to memory of 1168	4940	chrome.exe	92
PID 4940 wrote to memory of 2884	4940	chrome.exe	93
PID 4940 wrote to memory of 2884	4940	chrome.exe	93
PID 4940 wrote to memory of 820	4940	chrome.exe	95
PID 4940 wrote to memory of 820	4940	chrome.exe	95
PID 4940 wrote to memory of 308	4940	chrome.exe	98
PID 4940 wrote to memory of 308	4940	chrome.exe	98
PID 4940 wrote to memory of 4636	4940	chrome.exe	101
PID 4940 wrote to memory of 2800	4940	chrome.exe	103
PID 4940 wrote to memory of 2800	4940	chrome.exe	103
PID 4940 wrote to memory of 700	4940	chrome.exe	108
PID 4940 wrote to memory of 4288	4940	chrome.exe	109
PID 4940 wrote to memory of 3892	4940	chrome.exe	110
PID 4940 wrote to memory of 4820	4940	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.msn.com/en-us/sports/soccer/fifa_world_cup/game-center/sp-id-53452565?ocid=winp2fptaskbarent&uxmode=ruby&cvid=9c90fefc91914225adfc8b5f8b18fd26&cvpid=6a453eb667b148ccaa2d0a6ea02d9882&ei=8
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe9b19c728,0x7ffe9b19c734,0x7ffe9b19c740
  2⤵
  PID:856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,9943740150347861126,10336835502787502017,524288 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,10131642810912954451,12410894170661771166,262144 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,4172335706717118066,12658250105443899987,524288 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2980,i,17297483055944251330,15553377245156953773,2097152 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2984,i,915936373816429428,11230429703513389874,2097152 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,2174349698727337128,347323792011555788,2097152 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,7965274432069064416,12501761559021161886,2097152 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4876,i,12905755858674263412,2473877583137415059,2097152 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=2956,i,12193227349879472316,11944996864025631479,2097152 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4852,i,13780985376627719655,18291556598343764772,2097152 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:1
  2⤵
  PID:308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,7042077693182573212,14324744977475383210,524288 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5140,i,13907210438375342627,736000317554516943,2097152 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5128,i,11653892531757684807,15767568494138749009,524288 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5124,i,3684477215212755792,873553931807384048,524288 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,2637586316034570311,1482915847288297388,524288 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4756,i,15691561429075584649,2760456266306457353,262144 --field-trial-handle=2032,i,7978217413656326067,12610322411623998366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1f336f2892f0b4da5d9be8deec57406030905ab73681d3cb16f97950ccc911ce
MD5 31d2d0eed17b8269c0c7a4debc16956f
SHA1 3b13d3137fc469812f2386a7a8b7f6581811772a
SHA512 10f3e7f292eed16d07370a6bc4f6c8976358b812127aa4856d75a30e68755c644d8a199a0606a3918b8bbfb9c36d160193fb3aeb670a80b273bbc26625936d25
TLSH
T13BE02BAECA61AD2F08FD0728645C464AE654231B2B41455F3A3C87098FB97360A8AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d07bd8089a3eb7293cf8230e0e9b321a5efd11230744105419398f882ab6ebf1
MD5 b6540479bc7a1bb75a116e9b28eee4aa
SHA1 4966b03f33c8845604e19a7b5fc2f6337ade9fec
SHA512 a9ab359ffd7ccd9dd16b852f6200cc06fd80486737539c538c48587d48982b34a82c9cc81cd6391c97bd144028a97888ca3399fc254386dba150776c668c0d9e
TLSH
T14E51D616E6C7ABF4EF2E71350CA92C993430BB1040032BA7C07516ED7AEB2D62309A13
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a96f6e3aef63964145a55d2de4f8c83f9e963000856a25df5ce19c434aec3047
MD5 1d83461f32a30b9c0239971c4c47599b
SHA1 fb50f88c30e0b785f4c525976b2affe98cfecb46
SHA512 0a16a9b3580665684c9254fb5e38239a94bfa6e6ff4b6cca002dd39ab9f63c3e7190369068b39e4acfbabe43a83510b1cacdd99d3d56ca63dddddef2dcf74fd6
SSDEEP 192:DOeGOQW0e54EaIaEdBBi14n+GA7a5g10+9ooDnfM+KbwmRY7lGgHO:DOeGOQW0e54EaIaEdBBi14n+GA7a5g1S
TLSH
T108F19AF7C3B5856DDA1196F0AA146F1FCE19045243BC398A88D46F4B93F2872E152B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e1a1dbcd1f7de646d44f8a73373096e2af9f7edf6d02a901d445066b02bd3bec
MD5 8c393f0c1816400608100cadc678c9e3
SHA1 6230406d389f6d7ee36b96aefcae846eb3b54340
SHA512 6cc9af3b01f8fa2d9c5b2d6a116f2cbc459e134134257f6e8cfde451b0c5d3c01f6312238f2bb65df1a490bb2887990b896e48cb5100d4889810bd6a083a1a5c
SSDEEP 192:wRGOSGgvfByv72ympAPRp2tRQ95Hsb+WNnM+2BJ2rTIkw0aT6XAD0eVyIsnAUge:wRGOfseQUXh7wxs2gUamwFe
TLSH
T16142B62BB920653B9CDBD22AFE527717E7F9107121941E84EAFC8B1C15E76CC2227427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aff7624b8aae8c5bb1563fc74aa1b1232b9608fa7ed5d15f3b233c929caf826b
MD5 85ddef3a7b89b140032f703218ffcbf6
SHA1 74d6870bad9d8a54bdac3a173b4f5b7d6333d579
SHA512 0a9639f92469d6e1a10354f5b01dd2256e67e396b6bf151ec965c240a5e6a27cbda9a10e6f0cc9e6ed9bdbaa44db5e610a18d55388cba0dbf65153a495849f0d
SSDEEP 192:wRGOSGgvfB/v72ympAPRp2tRQ95Hsb+WNnM+2kSYkTIkw0aT6XAD0XVyIsnAUgE:wRGOfsXQUXh7wx8YRUamwiE
TLSH
T11C52C62BB910693B9CDBD22AFE167717E7F9106225C41E84EAFC8B1C15E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 42974203f492fad7362fd3cc8271b699056b7ab982e264ed45198da88ceee292
MD5 8108c6e3484322f3b8a822bfb7181d4b
SHA1 c81cd41d5a2408f6bf1e664c89077c395e38acbb
SHA512 c1f4f18d295d8e1ea213b5a6c233e152ee8624f6c7e347d6a0471de735b55e6415b0907297d47b6d96a04c0e26d9925d6e6a5f876e6cfe786f65ef8126f8ace1
SSDEEP 192:wRGOSGgvfBGv72ymp4PRpStRQ95Hsb+WNnM+2kSYrTIkw0aT6XAD0FVyIsnAUgE:wRGOfsyQIX97wx8YgUamweE
TLSH
T11752C72BB910693B9CCBD32AFA567717E7F9107121941E88EAFC8B1C15E76CC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt
Size 149B
SHA256 14bc0df708812c58eef9c8fd6f29a26bcd6d15fce8c0b45efc8cafc0998be83e
MD5 194440177aaf5dbc9993f2c70e903fdc
SHA1 af895394041ecc3fb0b41f650cf1e93d43dfb19d
SHA512 c7822a2390e2071bc2c31dbed4f084dbc31c6fe4a84e134e6897570abe126f1143c6271ee2e365af9b26de3d98bd0de9d84ce0370c5fd65d086f5bf2e195d321
TLSH
T13AC02BEB04004700D7DADBC41033AE64C337B1C4C0704CD6810501620C259A21CF3F0F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe585946.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt~RFe585946.TMP
Size 156B
SHA256 982e363070857d11f33f19dd03dfd99291fd230d870d5ebb45e315180ec6226a
MD5 eb7a216206e4132ec5be612bfe053ecb
SHA1 671723b8152c18f3db673788ef91c42d6082cddc
SHA512 b54ba83e5ac1710101481d36ad7cf80d8d0c798c6dfba89feca7ee5cbccfd3a1ef65c0e7fb19f4f41c31001bf68372f58e0332ca3e0c193180650c694663d008
TLSH
T1A6C02BE704040700D6E6A7C65033AE84C337BDC4C4708CE6410631520835A231EFBF0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9417923474949d539411b956e961a97610085a7cb3216019cb2b64c85ef7230b
MD5 a73bb0c208292c3f816432af3162aaf8
SHA1 74504fbc9a5dbf84f5ef054ff1d0055792d654cd
SHA512 2fccbfacc1a7edbc064bcf6dc69236ef0e940b219a3630341938c38a6c896d190c5692898224584a97b9268d232cfe6e66399ed86749ca96e0631f7fddb34fbf
TLSH
T141B0128284425101C00202F4154314887118EF11D60B2B0183E06D63D875750C424250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584fff.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584fff.TMP
Size 96B
SHA256 a2427e2319b60d478d6cf8f849224e9991d533ae4ea5a45e84ba050c164828f0
MD5 4f0eac96c4e4d8aa2a537959798ae59b
SHA1 3bd33fdcd449b94306a6d7217dc8cc664149cc37
SHA512 1274da543ef172a3babf475265b981d7ca142d7e10d95800cfbba7b2c3f5d915438b28eeb4e4f99ab71267b3d8b5b8b93ba5fbfb3c934a85b03399803ae5b683
TLSH
T1EAB02220C2022202C08303B03BC2A0CC3020EF20CA030202C2E80EEBCC20B20C020020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 2ac9e6f497c8a2db6134c0cfc8483ed4f54c99e46a42ddd0a4d219d5e4bbb877
MD5 16ad5e0f9462944dff018842452ac952
SHA1 ee7df1ea70d85d397f084c9d8ceaf9280aaa4dcb
SHA512 04aebf360064afc7125b9067ba10f51dbe62e46796f6a83751f2080eddd771a64fa020c392b6b93f0ca73f985ec668a22b9f84d15aa76dc849f624eca9b91ccf
TLSH
T102A0027672A19641C70002B96191816073B5BC50550943C5E0E199A789A11905606014
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 323494212fc2602c0ca9c6c53a4519226324e1743f603b8abdb9f62989c180be
MD5 664afb99c797e23d72548c12e6d30382
SHA1 6c0ee32317c163e4466e3cf23274fe2dcdd5db1a
SHA512 5793454dd1f3a46fc55df7d908efa3a6b5bbc53863e27cdbb401dfe34c63825fd3690f76cb0b2f6ee004a8aaa705ee2a739bd4c2d06d3999bf2958ff3f443919
SSDEEP 1536:TqQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:bqfd7NtZL8cHQRZEQ6Spsk
TLSH
T199C30237EBC21F339D96CB60B9530FD697B644A99034D301EA6D77AF6C83891684289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 81f5fc85cee5e6d17700c8a82280ea6dcef1701e370ca58f95b0c8aeca7f13c2
MD5 f678c454ceb755bd03b4610c91f55c7b
SHA1 e51736886f25e817ca5d7f413c8e102d8d1e9a96
SHA512 e28316f737460ce3bf6ae5fc41e64f97808d6bdafc9f93e92913e0a7cc62bd8d4a8c2de045a92b74f18f66a4ad951079a0a5067e4e4e6cd46c975be41ed6a991
SSDEEP 1536:FqxlyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:SLqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1A1C30237ABC61E339ED2CB70B9130EDB97B544A5D034D301EA7D2BFB6883591654289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6d7960df34771b10126dc35a9db4d772ce422207447d29ac5c7c30ca97b443f3
MD5 8560b72ecf4254066ef34ed27cce260d
SHA1 bc17a26eef4ca813adeed3fcbb721bb79b5998c8
SHA512 59c2158bcecbbf5d9dcc6264a5c64afb7e492c66a907d2d3517225c956e99941768bd651258042121e34778b653cf869854d5e545848c1ab7eaeb8ef407177a5
SSDEEP 1536:GqxlyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbz:VLqfd7NtZL8cHQRZEQ6Spsk
TLSH
T12EC30237ABC61E339EC2CB70B9130EDB97B544A9D034D301AA7D2BEB6883591644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f981b2d71f89fca3f604f5f3120443c0d8935541513d2d6dcef1ea6b877034c3
MD5 65051bd7cb5f00197ebd8975792ac0ba
SHA1 50594baebd1ea2e517d006ae0442da0c604a7b3c
SHA512 6b86c6872045a652857e1287b81fd4becb8ed5ce4fe610a10255939080bbba73fd1e5204b36d1ca39161ea8ab8535c2da7024df911427f882108c8fd1e23b841
SSDEEP 1536:GqyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:Bqfd7NtZL8cHQRZEQ6Spsk
TLSH
T1AEC30237ABC61E339DD2DB70B9130EDA93F544A99034D305EA6D7BAF6C83491A44289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download