hxxps://storage[.]googleapis[.]com/mywebinar--ads--20--599b0a27b0d0442fbc7f/index[.]html

Resubmissions

21/07/2026, 03:30

260721-d2hyaae19z5

21/07/2026, 03:05

260721-dk9pnsey7x5

Analysis

user interaction
yes
max time kernel
107s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.googleapis.com/mywebinar--ads--20--599b0a27b0d0442fbc7f/index.html
Sample260721-d2hyaae19z

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	14	https://my.webinarsinvite.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a1e72080293297b2	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
560	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290782284493920"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2428	4708	chrome.exe	85
PID 4708 wrote to memory of 2168	4708	chrome.exe	86
PID 4708 wrote to memory of 2168	4708	chrome.exe	86
PID 4708 wrote to memory of 560	4708	chrome.exe	87
PID 4708 wrote to memory of 4820	4708	chrome.exe	88
PID 4708 wrote to memory of 4820	4708	chrome.exe	88
PID 4708 wrote to memory of 4412	4708	chrome.exe	89
PID 4708 wrote to memory of 4948	4708	chrome.exe	90
PID 4708 wrote to memory of 4412	4708	chrome.exe	89
PID 4708 wrote to memory of 4948	4708	chrome.exe	90
PID 4708 wrote to memory of 3164	4708	chrome.exe	92
PID 4708 wrote to memory of 3164	4708	chrome.exe	92
PID 4708 wrote to memory of 3872	4708	chrome.exe	94
PID 4708 wrote to memory of 3872	4708	chrome.exe	94
PID 4708 wrote to memory of 5076	4708	chrome.exe	97
PID 4708 wrote to memory of 5076	4708	chrome.exe	97
PID 4708 wrote to memory of 3456	4708	chrome.exe	98
PID 4708 wrote to memory of 3456	4708	chrome.exe	98
PID 4708 wrote to memory of 4996	4708	chrome.exe	99
PID 4708 wrote to memory of 4996	4708	chrome.exe	99
PID 4708 wrote to memory of 4876	4708	chrome.exe	100
PID 4708 wrote to memory of 4948	4708	chrome.exe	115
PID 4708 wrote to memory of 4948	4708	chrome.exe	115
PID 4708 wrote to memory of 4120	4708	chrome.exe	118
PID 4708 wrote to memory of 3044	4708	chrome.exe	119
PID 4708 wrote to memory of 4648	4708	chrome.exe	120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/mywebinar--ads--20--599b0a27b0d0442fbc7f/index.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93b33c728,0x7ff93b33c734,0x7ff93b33c740
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,1438655275284545118,6773311295788404992,262144 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,10428585962926753070,5147432163744245223,524288 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,3213390627214563050,3691577440553608063,524288 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,12266199865632955566,6451058081197449684,2097152 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,14125520885652699809,7236801372718165892,2097152 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,8644608795979290874,13023950938487905998,2097152 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4432 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,13690359415631387118,5687806392047473117,2097152 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4892,i,13041082600989189894,1892193447813136525,2097152 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3224,i,218592546430079801,16030618777242624168,2097152 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3148,i,459877402663336038,9881327018693456203,2097152 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,5500831288112343763,10807743703212303508,524288 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6008,i,17097326596509621092,14341532435922418696,2097152 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3152,i,15093819659301312439,14215103693361566748,524288 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,17545097727068743785,6571806754450373181,524288 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,17191295994317346932,7095276915899715553,524288 --field-trial-handle=1800,i,5651413090427295433,17556076432644256513,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:4648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2206f014b69e209145833ceaa96b0985cbefb42ff35f46573d736e5dcbdbb5e6
MD5 e5b3681dcf6286a5d26395fe29a51bcf
SHA1 10675e3ec6818ace3ccc48f7e4655c94f5529ab1
SHA512 c7bd11414cf683fe63dbcf23d4a55743726b165f4480f6596eb3a3abe45fa2ce2ef3d257d123e10ff5977736e08e3df3251855f33c4ee98258f959814c9b2eea
TLSH
T16FE0AB69CA22DC3708FC1318A4614B05FA4123176B80980F773C810C8FB933A428681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 058357e837228d2a87e3009105f41eee84fc92387bfdf2163a02dcf87ab31a36
MD5 8025e06ea253d52aca356d8a62218848
SHA1 7945f1d256652c223fb10b74993de85af1085a9f
SHA512 6ca5cbc9766b34a768200a00f4eac5116cd16c63351e702da0fbfefd44e5c7cc963817505a312a9b56daa8f4299d18444b9372f12f43963e6495be0f2a2f3997
TLSH
T179E02B852180814DDF158FB0ACE769593150371C8CD7E9ABC0A8345054899F40597467
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 0745f036e2d589d88bb3b04fef8c5f0a8340cea5570bd2ac2f5a9b8d51eb4f48
MD5 e95b01d16d0f3503f34686a037f0a55e
SHA1 c54744e24acb70965a05ac6266d5a07bbc50a48b
SHA512 54855568ab47bbfe840f246c0b72a36c22f00718362eb581a186a0cdb9b2d5d4faa1dd3cf317672d17df5df0e6ac76dab3ca5787f62c6a7690fc25a80b60b7da
SSDEEP 192:DvicQ0jcaaIEdkqS3BuljljO7srnkj32E+Yn:DvicQ0jcaaIEdkqS3BuljljO7srnkj3r
TLSH
T1A2D1BBFB87F8837D895092F4AA593D2ACF2D0564431C3C9BC9E8AE4B93E1871D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 58bdc9cd2eae6c1d02d68e14048d9ad0abc02832a1f00de1e2a2f2a14775ac95
MD5 f6c29b3ecba384d38b748533bb314a82
SHA1 12d23d62630def5b1c22137b8b2c0acf555baf51
SHA512 67e7e6b89bc22afbaacbff9be4a42dba5fe6ce41c991a8f71e9248420a0f9372b312149513a5cc9d3dce7a343fbfa648184daa654f62f1e21e4ee2c23981fd4f
SSDEEP 384:FR+np2JBThgoZX6s1w5xp4o9X272PdJBE:+np2J5yo31w5Mv72K
TLSH
T15552945BF9102D7BACD6D229F956BB17D3F5202166D02E88E6FC8E1C15EB6CC221301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9078873037cc4c61f10dcc3fe1973cf6afd9451404017289becb76406a77ee4f
MD5 99084ebc3bd198842bfe431e09c71c85
SHA1 1e2db11247f9a98c2f9fda95059c4eb694f90d78
SHA512 c04bf15822d1d893e6584f1d197acc150254ebc64bf83a8f7748e2322a5d4b0931e19e3bd005d8c26d1c2d9280a70ced90deb3d28565ff54f8ec17c5ce2e299c
SSDEEP 384:FR+np2JBTJgoUXRB1w5xXo9X25GG2PdJXe:+np2J5aou1w5FvoG2i
TLSH
T15652955FE9102D7B6CD6C229FD52BB17D3F6102162D42E84E6FD8A1C15EB6CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1ecfa0640f30544eaeb682813e08917bc3c0cb8156334bae4e0a854f886e01c7
MD5 ab059c73e8554890ceb9f8a94cce96a4
SHA1 311b683b8f817b0c9853abfa4d0d1fdf73e548db
SHA512 aa667d41174febfa2b8d042e8ed4278c1e273261c515adbf16f5981fe851b2ab8b252ae2814bdc0bc1fd411c3aa0005385cb42949506cc9833907628daae11d7
SSDEEP 384:FR+np2JBTmgoUXRX1w5x56o9X2L2PdJrE:+np2J5joo1w5evL2U
TLSH
T1E952836BB9102D7B6CDAD229FD52BB17D3F6102162D42E84E6FD8A1C15EB6CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 22ac4f8c10a067e10d33076203194231c85e412e9cef8d2464acefd3d0a0b885
MD5 d270376b59795b3cc905f4051da30dea
SHA1 778181ccdb71c30b591c59917e97ca07c320befb
SHA512 b14baf21b9ffdeb17857d61c84b4f47e2df9ffd869eba6bb61914f3eb3e568d3ab8c44a05d63e9422dc3eb14d242a6b80aeda59e85404083272bfe37e30150f1
SSDEEP 384:FR+np2JBTqgoUXR+1w5xB6o9X2w2PdJ8E:+np2J5/oR1w5evw2f
TLSH
T1BF52936BB9102D7B6CD6D219FD52BB17D3F6102166D42E84E6FDCA1C15EB6CC221301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 34d3b150d9ebc3413240a436dcd8cc4d2da0e46d00a681d2118263aea9d32f3e
MD5 73285efb9f7ee0bd384426865ccccf8e
SHA1 51903f2b7a36fa90857257254c2bebdfe5da7eef
SHA512 e9bab3e8a04453bd7ca516137298f57170d38058ccd5df170108532fdb6eefb2d5ae94de47967a5242cb07be597050bef4f69d7f740877c626e131f01424e28d
SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcSjFgXODPO+ErU3voHGjBm2oR0h9:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pM
TLSH
T1287219676C4C8E7B0F94CACCDC167F4F9DB5025B65EA886482FA582903D5ADF01061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3ff197632f04f7fa3c4849cbb0522d64368c1d96abe85921cc9791410d6592d6
MD5 07eaedd32075f0b04a4d9bd0ce690bc9
SHA1 d59f6b749cd32cf276a4e36e5e23ab9c166e5626
SHA512 88ed2e4105bf301844e48b6156c11cc3fcdc64481ade98f2a356ec7b2d7187a8ea3d0ac8cb71b4c38314d102122c188c715015daa5dae61fa218accf00aa25c0
TLSH
T1BCB0121080016581C44B02B01553148871545F20D60E170143E47922C8261A28025051
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b570.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b570.TMP
Size 96B
SHA256 c411feea82555cf1fcfcbcbc5b4de24caa77441ef020591982bb9d40cfcd5678
MD5 eaa04ac0831561275bd673dbabce608d
SHA1 4046c4d67e00c2999d69147df6931625e12ca06f
SHA512 6831e0a171f1b909f03b767ae627230d8979f54e4f5b3d261fcc96581d07a9d45860f0673743979bc722b888dd1257781b33415b9dee07be68398981f468a21e
TLSH
T18FB02200E0223302C00203B023E088CC3020CF20EE03022282E20A32EC3833A0028030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 177KB
SHA256 9590fff6c037ece07fe0bc35d1960371ae711acf2347df63a69d3013b926f833
MD5 3a78e0b102cd553f4fe3ff2c532472ba
SHA1 a1c682e8eae8e63b9ec2d3bcd93153db6f722037
SHA512 38f1ae44b1f9aa9a36a8e59a43173d51bce3b67f9d3434b18386c9070d6390b611136e71e6012178630e2f38aeae684cc3e3ce2a9960c10dd744a3a853a159a7
SSDEEP 3072:8kFuKvE5tXcamwnYBBt+0eGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:8HpnAH+cm7Rkm1tYpBeh2BAoM
TLSH
T12F0412337E76E87A4999A71A74CA5E1F0FF24572D424ED76C8E06E0823EDAC80705B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e8a96d1d8364f2111a44111e3e2563146bb71b5e62aae17c938d638273852dfe
MD5 693e45b46da32556941f3e60602d2d24
SHA1 1af0c2406871c7badd7383e5df5ecb2479bbd562
SHA512 b2ff960c38f0772735f4213c3074b6268403d13a74043ac2669dae82df9aafe1a695a7fc5cf09bb3a99a54ad430083e5db69423021196b11b5d1523337c66f39
SSDEEP 3072:8PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:8em7Rkm1tYpBeh2BAoM
TLSH
T1CBC312276D75EC3758B9B71EB08E0B1F1EF149A6D920DE92C8D85B0423FA7CC1A49934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ed65271434f303b42b14c64954c00e73556e466ac59a92f939b67ab9e4468d99
MD5 b300e15fcdd0ad0cfc652ba8c9afbc01
SHA1 42f667055d0c9273f9e0a2d93e5c78eeada596e5
SHA512 6b8e22672432ddabc3fabd6d6989a3e85906deffc9a274ff79af079fa9568c298a5e0f5af76dec77eb514a73455707cc0983ac9624546b7bc1b60e2e0c689be5
SSDEEP 3072:tPGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:tem7Rkm1tYpBeh2BAoM
TLSH
T186C312276D75EC3758B9B71EB08E0B1F1EF149A6D920DA92C8D85B0423FA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 df5a5c2d14de424e955b2c6fe0bf0cb59ca2ebcb2584e059de534bbf8371acfd
MD5 9a1d990cb763ab6b1173f98ec7cd2449
SHA1 2a7f1cebe83ba48efa6b4b2ab8b5df0da76a7917
SHA512 a1969421fb36d8b687a9b323d9a7204a2a9fc5f62b6958d16d944540fc322f38525b0f8bebdfc4934b360ef40084d319deff49543e71c7437ce188634896ed8e
SSDEEP 3072:/tGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/km7Rkm1tYpBeh2BAoM
TLSH
T1DFC312275E75E9375878BB0EB08E0B1F1EF14AA6D930DA92C8D86B0467F97CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download