hxxps://nam[.]safelink[.]emails[.]azure[.]net/redirect/?destination=https%3A%2F%2Faccount[.]microsoft[.]com%2Fservices%2FCFQ7TTC0K5DM%2Fdetails%3FopenPayNow%3Dtrue%26ref%3Ddunningpaynowemail%26OCID%3DAID_ema_TRX_SubscriptionChargeFailureUpdatePayment&p=bT0yYWNlMDlhNy1kZTY5LTQwMjUtOTg2OC04ZGY3Nzc1Y2FiODUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1kZXRhaWxz

Analysis

user interaction
yes
max time kernel
210s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Faccount.microsoft.com%2Fservices%2FCFQ7TTC0K5DM%2Fdetails%3FopenPayNow%3Dtrue%26ref%3Ddunningpaynowemail%26OCID%3DAID_ema_TRX_SubscriptionChargeFailureUpdatePayment&p=bT0yYWNlMDlhNy1kZTY5LTQwMjUtOTg2OC04ZGY3Nzc1Y2FiODUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1kZXRhaWxz
Sample260720-3fefeaax2t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5052	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290636363133630"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
4204	chrome.exe
4204	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe
Token: SeShutdownPrivilege	752	chrome.exe
Token: SeCreatePagefilePrivilege	752	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe
752	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1512	752	chrome.exe	85
PID 752 wrote to memory of 5052	752	chrome.exe	86
PID 752 wrote to memory of 1228	752	chrome.exe	87
PID 752 wrote to memory of 1228	752	chrome.exe	87
PID 752 wrote to memory of 2844	752	chrome.exe	88
PID 752 wrote to memory of 2844	752	chrome.exe	88
PID 752 wrote to memory of 5080	752	chrome.exe	90
PID 752 wrote to memory of 5080	752	chrome.exe	90
PID 752 wrote to memory of 4344	752	chrome.exe	91
PID 752 wrote to memory of 4344	752	chrome.exe	91
PID 752 wrote to memory of 1680	752	chrome.exe	92
PID 752 wrote to memory of 1680	752	chrome.exe	92
PID 752 wrote to memory of 2780	752	chrome.exe	93
PID 752 wrote to memory of 4936	752	chrome.exe	104
PID 752 wrote to memory of 1936	752	chrome.exe	105
PID 752 wrote to memory of 2408	752	chrome.exe	106
PID 752 wrote to memory of 3136	752	chrome.exe	108
PID 752 wrote to memory of 3136	752	chrome.exe	108
PID 752 wrote to memory of 1288	752	chrome.exe	115
PID 752 wrote to memory of 1288	752	chrome.exe	115
PID 752 wrote to memory of 4204	752	chrome.exe	119
PID 752 wrote to memory of 2456	752	chrome.exe	120
PID 752 wrote to memory of 2456	752	chrome.exe	120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nam.safelink.emails.azure.net/redirect/?destination=https%3A%2F%2Faccount.microsoft.com%2Fservices%2FCFQ7TTC0K5DM%2Fdetails%3FopenPayNow%3Dtrue%26ref%3Ddunningpaynowemail%26OCID%3DAID_ema_TRX_SubscriptionChargeFailureUpdatePayment&p=bT0yYWNlMDlhNy1kZTY5LTQwMjUtOTg2OC04ZGY3Nzc1Y2FiODUmcz0wMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDAmdT1hZW8mbD1kZXRhaWxz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa9c45c728,0x7ffa9c45c734,0x7ffa9c45c740
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,17773444544350145438,15115600508224651769,524288 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,7782783983635998442,4040673160945118922,262144 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,1009478002789558304,9090927162280967960,524288 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,1573443514379595983,4568100828084068956,2097152 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,4514164923341886576,623448775303194867,2097152 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,9367243197710393569,17784780535540451918,2097152 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,2424454860462391574,5663968646787742158,524288 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,4783885664029861592,15582047664592433852,524288 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,944765899029333116,14017590884563742177,524288 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,8155651978154747177,11993792350649149857,524288 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4512,i,12719921298287079891,6151877815370545871,2097152 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1656 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3596,i,13193296625139406911,8716012338883483451,2097152 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5692,i,8750623900929951301,16692223267108222316,262144 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4412,i,10650332036321739674,5295631230376096499,524288 --field-trial-handle=1924,i,7067872026544895414,15540208590761296132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2456

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d8176a18d0e87749c6ce60f3841147a7bd4b1359872376917e23ab82db90f38c
MD5 b2738da844a41554a0f09e23a0488fbe
SHA1 7aa34d60f8e6f42351a644c0098444a5cbe70763
SHA512 0f9f823e5fa25c8badcae0d1ea700ab3f7c030284f5e5d67b8ff92e5919fb805902ca433ba53c1202eb69d2d69c16ef99b9145653879107d880b1ba381bfdbb5
TLSH
T177E02BAEC8219C270CFD1B2920501645F74013167F90D90F3B3E86088FB5A3A8266C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 19d4b5375419e5c999712b7e5e929e6c33a97417398003b0f1500f9ee59bfeda
MD5 ff43c8315ce82af9bf1c5b5e2d410b59
SHA1 f5ada7ac214e58433a1e0e7bc050625c82183c37
SHA512 2b01829ba2133c2e5f48406de0da9e43f3999d6c4351f6d74c1d6f4af7cb9bec50a9ce106ce0dfa33fc05c933e8d7654419b7e46333d6dcc7724857efa318f11
TLSH
T1DFD0A700DFD4F617CF544377C09E680073A408785056071F87C0639010C30D5DE47DC5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f772c6c93bda4bfe59829229d5303275375602a02fb77a6acec7d861af13a7c6
MD5 95690d54dbd4156e5104ae5f2e8c3eb3
SHA1 5c60fb42a176b262c39f0985e5b82e9ee24a7024
SHA512 4e7d7b133275d121d1daa46d280a81dd5f5d195eec40b35758e7f80d96911170f603ef768c905e6c7c7caed7435834b5349d4809244595458f2a868c6c0840bd
TLSH
T160518CF787B4857ECA1196F8AA14AF1FCE690514032C78A6C9D4AE1B97F2871D10174F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a86ea459468f34273a7e71d33c4e7f90055c7e0037abe7a75bcd3d99b130f5d5
MD5 afcc8fbbc772809bbf80e5f30dcd0c71
SHA1 b85c42201bfc6d72abf3b895c04855bbe7d09981
SHA512 07327af1d2014a70d66001557e4da9a7a039ffe5cad4e0e1f6ef0dc4c582fa92272da104bc50c55813f8b74723a440cd1065d3e9424b4cde060c510f9bdff353
TLSH
T1F1619CF787B4857ECA1192F8AA14AF1FCE690524032C3866C9D46E2BD7F28B1D14179F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b29d6f9cd2537a8ab83746787267a42c98c87f0d20b7cf34a6a1af4684e570c9
MD5 3e0d4d021a22b06a4bbf1f4c749a3aa1
SHA1 c388e87757913c0ce514e091f50391a847ed34c9
SHA512 ce277c85f42b88182c11eab2aaa766134be11dafa66b50a1a133295f3fba3b7ab8f81fc5a0ad8790304552af4a373b5c4a9fdef1df091957101e59c03d2a73ef
TLSH
T19841CDF783B4957E8A1092F4EA14AF1FCE6D0624032C3CA689E46E1B93F2872D10075F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cf43cdb4be3ba900a92d260f6f6fa00f5ed671fa5f37f22538b4e073d569708c
MD5 ab6ad3ac321bed846eaa5d6c959f1974
SHA1 1de38491e156362b0a70fc67bcc86674c45bca32
SHA512 b1eff7300c4ac353a2e946583ee6449816f9aa7fe950bf5cd64b86e2997c960a2a04212180f650a014b60da0440a9e0a487b28d9635f2d09d3063f58478b8c6c
SSDEEP 192:4RN9A9DzQev7cpAPRp2qg9BHsb+WNnbHP/kWTXgVyIsnAUge:4RN9QgawUXlgrwbPs6ke
TLSH
T19842E72EAA10697B5CDBD229F9657B43D7F5102625902EC4E7FC8E2C15E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 099dd7b55a8847f95b0f6a856accd65fe77a002bd09c9b5fe276165f9b4d95cd
MD5 cb7137525eb38198fcdc593075f53090
SHA1 105fd26e73c723dd553f544d31504220bc166726
SHA512 db8a9758e5a440ac12a95747e2537706f65a9fa5e6612ec91df5d97b483af00d242948fcad9a7eb341c112c1ae5eff471b82132edabc2f0269a5fab52b9055cc
SSDEEP 192:4RN929DzQM4v7cpBPRphqSFo9BHsb+WNnbHNbz23kWTugVyIsnAUgE:4RN9egMkwfXUVrwbZ20FkE
TLSH
T12B52C72EA910297B5CEAD229F9657F53E7F5102625902F84E7FC8E2C15E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8d7f35e8c7621bf1859bed09d1ece764611125c7f878f270c749e013b4ef11e1
MD5 69d966e5ef1f96c29754db4ae95fa2bc
SHA1 57a1e8dac202cf99a2601fed9998680f405c78eb
SHA512 44d50e8091e2fd40317896b18f285b66b33ce1ccb10e7ec815bcfa095d6be48916044e6a427d154e498881278e6f47a4acc0aacc4553bd7f19317bf5545deb67
SSDEEP 192:4RN9A9DzQM4v7cpBPRphqSFo9BHsb+WNnbHNbz23kWTugVyIsnAUgE:4RN9QgMkwfXUVrwbZ20FkE
TLSH
T13952D82EA910297B5CEBD229F9657F53E7F5102625902F84E7FC8E2C15E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 67b32e5e6ff51ffcc31b54a99c24c02caf90c7e2e5c386683a33b80ec95a72c1
MD5 2276f32ac6a10e2b4d685a22184fa834
SHA1 10582af8048cf8bb18b30fd5db0f7aa95a8bf324
SHA512 b67ce8ce780a91aade3ad91cb08f2e8f7cd97db8d990b73c980be2f712cbeb566acaba6872ad84aaec4d9f6c99cbdc1b944552fe902474bdd06b4f18180d6f78
SSDEEP 192:4RN9A9DzQDv7cpAPRp2qg9BHsb+WNnbHPjkWTIgVyIsnAUgE:4RN9Qg7wUXlgrwbPAhkE
TLSH
T1CD42D82EA910697B5CDBD229F9667B53E7F5102625802FC4E7FC8E2C15E7ACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 9ccf4e2c9a51d5e8b9611685c2011cafb8e5a679591b556187211b9c50b5e20d
MD5 ff241788bf58039e11ffc4951de44441
SHA1 35bb9bebc181b3bc0e3c1e9d24842c433fc8f9d6
SHA512 2dbf0b9cd7daa739e3d4107d537da6fb373426ee360a360cf3188e8ad0c02b33d20c984d05af86eb0936f8306126bdacb296fc4478e36c8ac73982fe494659de
TLSH
T120B01200D0415112C08302F01E82588872149F20960E170B43E07E27D8251B1C014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bacf.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bacf.TMP
Size 96B
SHA256 4398e83ab6521afefd7e6d523a29d1bb17e786aaaadc283bd0a77327d3ce82dc
MD5 9ce90cd4c6fc40796203ce0176eff024
SHA1 6510e2432b800ba76722a6bd8c8719850078116c
SHA512 36fa26e19f59f2b31e7c43256230c68523256564e9e4b74e3bc320d8cb5e9b5a4ee31ed9655a89f4c82dbdf63c30ffc5be6735b397ea14ac56c542ee126720e0
TLSH
T16BB02200C0032203C00203F02082A0CC32E0CF28C203020382F00A2ACC2033C00280A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 76dbf430803f14496b3ee46cb87372a87d1923fd1a00e51e3aa02b1a340f5427
MD5 058f23c93d6cda4dbe1e41e892e9017a
SHA1 3a15902b155f8627c77a4181a73707b0c74ebf3e
SHA512 eabb04a07a1caed8ff9873353f51dfc64d3236f6543c29e7d4a2f5957e714f5d1d4985ad8484070f50649f6f40bbddf28e31042af233484b4b57d951cbdf4b3a
SSDEEP 3072:S9oFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:GoFmUi21rSm8uUVNSlzY/
TLSH
T11EC31210B9A3ACB3FE9931447ADE26148D6C0941C291C60157739E415DEF3C66FEAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5b53e7d381b37c70b69d54eb6d96d27eea815d99d9dab273cfed0a3473133e53
MD5 8378a70ed9e909302189d23d97b0b454
SHA1 849f99cacc6f05aebf99d6fb727bd8df6e498475
SHA512 7020daeaaef4d9a20861a6e80fdf93a6ce3ff08049ffc26010b71742c7c6eb3deda1f67c67fe1db758d40cc3a39e231bf9100d5ece3cca6f97782f9974aec0b7
SSDEEP 3072:SxFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:qFmUi21rSm8uUVNSlzY/
TLSH
T1B1C3130079A3F8B2FE99304476EE3A159D680D818291C64153739E419DDF3C61FEAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7411987a377468870c7546482c011a33b739895475ec73092792e2db5d7e6749
MD5 ebb1243d0792292630a1f227d863156d
SHA1 2f92d6fb5e0ce7e730f434f6575e6b52e7ae4218
SHA512 cb44044394b3f10f7baa06a3f35e6a4b400742b3772f47eb129f1885466dc7907efb59c6e3c9ba76e35e37aeae494d1e34817c17cb0ab2a19ffa196f83641b16
SSDEEP 3072:SxFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:wFmUi21rSm8uUVNSlzY/
TLSH
T1CBC313047AE3E8F2EE5930447BEE2A145D6C4D818291C6415273AD419DEF3C61FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ceb50384ef2d73c27bfbfcdc855b8e3cb2c30113ba9d9780f02c8c29f47c33b6
MD5 ed18831ad941bdd7114d1661a644564e
SHA1 54cd28d0a75317c35b8f00d267e45fb8f303db1d
SHA512 bd78a0a4b7d530b08236f459553a573853145410c2453f46e04d90cba238f964597ba031de54933258936a3db1fe66f1491e3bda3f0bcec4f89d75dd8aa97e6b
SSDEEP 3072:SBoFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:GoFmUi21rSm8uUVNSlzY/
TLSH
T182C31214B9A3BCB3EE9931447ADE2A148D6C0D81C291C60157739E415DEF3C66FAAB34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f50b06a3a37b1ca8aec23efb96c5f59f5820783eb397c2a507dde35508c1121b
MD5 8daf4ef7fe618e6b14c9336ec6cd7a55
SHA1 6ad0ba53825a1d82be2d27dc39e2def98b57ab03
SHA512 5bf796c901102f5f9a94af293f1c5bdd2ae74c6173f780aec564adb721f1610d9e59d0bc21efe18346c307dde5f58448ecf9180480123217f33d59e99698b830
SSDEEP 3072:SKFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:3FmUi21rSm8uUVNSlzY/
TLSH
T1F8C3130479E3F8F2FE99304476EE2A159D680D818291C64157739E419DDF3C61FEAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download