hxxps://1e56dbe21fcb4e23bd180898e86de843[.]888[.]us[.]prod[.]marketingusercontent[.]com/api/orgs/1e56dbe2-1fcb-4e23-bd18-0898e86de843/r/0RnC8MOjukeXIGgvfxsAAAMAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fabout[.]ads[.]microsoft[.]com%252Fen%252Fh%252Fa%252Fmicrosoft-advertising-evergreen-en-us-9%253Fs_cid%253Den-us-acq-other-src_ntr-sub_evergreen-flx_emailnew9%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&msdynmkt_digest=5aiLCDPDnEni0CFCBFaMtLnvdR%2ByHlBtMkzsHwXPP3Q%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf> <hxxps://assets-usa[.]mkt[.]dynamics[.]com/2981032c-229b-4d25-9301-305c6b955409/digitalassets/images/2fee326c-01df-f011-8406-7ced8d6eccb1?ts=639019825794731270

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://1e56dbe21fcb4e23bd180898e86de843.888.us.prod.marketingusercontent.com/api/orgs/1e56dbe2-1fcb-4e23-bd18-0898e86de843/r/0RnC8MOjukeXIGgvfxsAAAMAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fabout.ads.microsoft.com%252Fen%252Fh%252Fa%252Fmicrosoft-advertising-evergreen-en-us-9%253Fs_cid%253Den-us-acq-other-src_ntr-sub_evergreen-flx_emailnew9%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&msdynmkt_digest=5aiLCDPDnEni0CFCBFaMtLnvdR%2ByHlBtMkzsHwXPP3Q%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf> <https://assets-usa.mkt.dynamics.com/2981032c-229b-4d25-9301-305c6b955409/digitalassets/images/2fee326c-01df-f011-8406-7ced8d6eccb1?ts=639019825794731270
Sample260807-ww3plstyfv

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
41	1800	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1800	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306002479576155"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4956	chrome.exe
4956	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 2932	4820	chrome.exe	87
PID 4820 wrote to memory of 8	4820	chrome.exe	88
PID 4820 wrote to memory of 8	4820	chrome.exe	88
PID 4820 wrote to memory of 1800	4820	chrome.exe	89
PID 4820 wrote to memory of 2820	4820	chrome.exe	90
PID 4820 wrote to memory of 2820	4820	chrome.exe	90
PID 4820 wrote to memory of 4480	4820	chrome.exe	91
PID 4820 wrote to memory of 4480	4820	chrome.exe	91
PID 4820 wrote to memory of 4404	4820	chrome.exe	92
PID 4820 wrote to memory of 4404	4820	chrome.exe	92
PID 4820 wrote to memory of 1468	4820	chrome.exe	95
PID 4820 wrote to memory of 2044	4820	chrome.exe	98
PID 4820 wrote to memory of 2044	4820	chrome.exe	98
PID 4820 wrote to memory of 2904	4820	chrome.exe	99
PID 4820 wrote to memory of 2904	4820	chrome.exe	99
PID 4820 wrote to memory of 972	4820	chrome.exe	100
PID 4820 wrote to memory of 972	4820	chrome.exe	100
PID 4820 wrote to memory of 5108	4820	chrome.exe	103
PID 4820 wrote to memory of 1448	4820	chrome.exe	104
PID 4820 wrote to memory of 976	4820	chrome.exe	105
PID 4820 wrote to memory of 4956	4820	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://1e56dbe21fcb4e23bd180898e86de843.888.us.prod.marketingusercontent.com/api/orgs/1e56dbe2-1fcb-4e23-bd18-0898e86de843/r/0RnC8MOjukeXIGgvfxsAAAMAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fabout.ads.microsoft.com%252Fen%252Fh%252Fa%252Fmicrosoft-advertising-evergreen-en-us-9%253Fs_cid%253Den-us-acq-other-src_ntr-sub_evergreen-flx_emailnew9%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&msdynmkt_digest=5aiLCDPDnEni0CFCBFaMtLnvdR%2ByHlBtMkzsHwXPP3Q%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf> <https://assets-usa.mkt.dynamics.com/2981032c-229b-4d25-9301-305c6b955409/digitalassets/images/2fee326c-01df-f011-8406-7ced8d6eccb1?ts=639019825794731270
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffff878c728,0x7ffff878c734,0x7ffff878c740
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,158785785062292934,10014018232971750166,262144 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,980930097293203398,9351409756650589034,524288 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,17378441410492327657,14167448490814259443,524288 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,5589042038774727993,10695014389453387614,2097152 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,2738144691001555235,10506172068386834878,2097152 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5136,i,16290284912643214503,5422429619593645759,524288 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5420,i,10029497099901880784,3203218694446320194,2097152 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3276,i,3413523348401433833,3794000620891107773,2097152 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3264,i,1995175057429069305,17001027937317145105,2097152 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,5530861761202891053,9917315141637692270,524288 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,12457338659174779728,12513478158558822699,524288 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,16991647280338425227,4221554846086035661,524288 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5336,i,15121369227204022445,2710834764217314378,262144 --field-trial-handle=1988,i,13853879532861322307,16756116365755040569,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 99600bb4e78cdb79e0f43f0476a3f98112af5834b414f8b0b80de1e032f4c989
MD5 2ce19cc08e0f945ce00820bea72011e2
SHA1 1fa8a7fe2cf11a58b4214c4d462471bbb1ec5e29
SHA512 db7ada36885f611190f81538280a026396dc188301fd783a2bed233ff1b4ad8c4ac9e17badcc5d4d739f4a8f538ad0a8fec7784a9716a99623ba8788a5ccd051
TLSH
T1B6E02BF9CCA1EC3B28FE171860558746E654135B2680495B7A3D950C8FF1B3E5655C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 53da4e628b7db95a3b0abffd667070c1662b7e0f5de5be5eaf43b67d185dfd54
MD5 936d48e3d5c8dd65dc09c8058b13c152
SHA1 abae3c18ae43a8d2457d0fe9b08925bb15832444
SHA512 06f7a27c5d436324b25d467647b97e4274d7ed1d75b06276735906167f29beb837359c521571f6e734b68b5e7ce979c569f3cc00e5f073241abbabd687b6c202
TLSH
T11E01241CCEC59354DBC6AAB04AA4091AB8332D126D17DB8E7F120FB87013FF042010C7
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b4e7d2e705dc7e4474070e9334a3e8fd9371d4f36663167b51d581dc885d6a3b
MD5 83ee72ccad15555fada63be578b45628
SHA1 08b5c977dd0cda9b8df783d45729db1a115ed968
SHA512 7fb501a9067bc04f7c764a79b64c6abd0f00be1b85e2c3705f0dd838aec4266f506be7be092405b2855f40543124998ec2e12df89e3e72f1c59dc6d17bd70439
TLSH
T1B8618CF787B0896E9A109AF0EA14AF1FCF6D0125535C786589D0AD33D7E38A2E00579F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 43f20eb675191d4fa854373f9059811f438414c51c0743376df4b3c834235927
MD5 996c3381b35e13f53a230cc1f172d138
SHA1 4d42d2b78573fce2abc71440314ae4360e38fa59
SHA512 f3925759695de4b7cc96892d75b6e762281cec6bc085aef7e15d1cdf7d575dcedd93449f1a079d87f282d20d9127364af73e7a3025c528d455b9175265770067
SSDEEP 192:6RroHoLv72vAPRp299THsb+WNnzlPpBecOaJLVyIsnAUge:6RroIzC6XuFwBP2abe
TLSH
T1C732C62EAD24757B6DDBC21AFA627727D7F6103125D42E44EAFC892C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 532dc431ff91e94e1110442f940f740b2e43719b26dcda0a2c3c59bfd2f5e320
MD5 0abbaea6ac69c7ddf755963a31dffc6b
SHA1 4166ae8e7e42803351de198992c668348bea2355
SHA512 fadac1c7be8d3d7d5e5cf55ee2022d2864ad1f8b416a4bef67eaf7a9746d02ad542c1b53500a35f8814a832a212f91910511620bafa59749a901c8062ec12664
SSDEEP 192:6RroHoTv72vfPRpnEb5B9THsb+WNfcwzllBN62JKBecOaJjVyIsnAUgE:6RroIrCPXOBFwf3lq2ja7E
TLSH
T1CD52E76EAC24297B6DDAC219F965BB27E3F5103125D42E44EBFC892C14E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0112a65c83b10b1fd0f8d4299c9a3b1cc0f30f65d7ff2ec0392a59fe72ba69a7
MD5 d2a2e45732afc0a637af418759be8347
SHA1 557010444419e6ab514204e7ee074bd79dc2ebfd
SHA512 5f026ee2053f222a2625627ad39d833e5d94c5d65490e13f7c9c569fbb01590c2e346188c6902cb899c6d75587bbbc988f90ef951c515df340766f5dd9fac80c
SSDEEP 192:6RroHojv72vAPRp2Eb5B9THsb+WNfcwzllBN62dBecOaJfVyIsnAUgE:6RroIbC6XtBFwf3lq2qavE
TLSH
T11342E76EAD24397B6DDAC219FA267727E7F5103125D42E44EAFC892C14E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0e22b4b6d3088954b858fd68271ca97cad5023ec54d8a786f33703ed5e919fda
MD5 ddb6244a4ceadfe30d17cc59d4bd0140
SHA1 af457d9a27275246371ef62613c08a8ce3954566
SHA512 7194bd997bbec2c9abd9ed2745dada0bff3c2ff645d42f6fa165a97c63f9f25da6e16561d06b2cac4a857705b34a84f165757b4c9881658aaf76e0e903e5161d
SSDEEP 3072:IiGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Im7Rkm1tYpBeh2BAom
TLSH
T1CEC3023B5D74A87759B9BB0EB08E0B1F1EF14AA6C930DE52C8D85E0437EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7a79874e3e9dbaddc42428749d775e494f8d6903b43baae929fd2ae8f5a0a75a
MD5 5efdc8f54f9d22c1c1f5ec3a6eeb1283
SHA1 f82e731fecf267f342beab3d449eec76e0670570
SHA512 1d62b898021e45a6e047343b090bec35331ce60158b9b0e6816c6420731041615cab5cc52043e4554c7b57d9e6f774027dd14a54c81ce1b7ebac707ec5843362
SSDEEP 3072:pEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:pnm7Rkm1tYpBeh2BAom
TLSH
T161C3123B5D74E8365DB9BB1EB08E0B1F0EF14AA6C820DE52C8D46A0437EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3d5c9d0b134f64a28cbf49efd9a5dcd3b4e0481cc3e8f9c0f3348bbf30192443
MD5 d7e13c5074b38b8967cf8fe91b00e46f
SHA1 0d20269f2bfab7b1d5032fcff90c0d513f6b94b2
SHA512 cbf654a1c6c8bed830caa9eba558cb3955bae0d8f34a5fe8ddc160d94e94c461e1c8c314503c256ff2659dbfd2532edc3f5f4a14f9d88c62bbc0734918f301e9
SSDEEP 3072:DGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:6m7Rkm1tYpBeh2BAom
TLSH
T176C3123B5E70E9775979A74EB08E0B1F1EF14AA2C930DA42C8D85A0437FA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9f8bb82a1bb0347616931242823e32f3fbb2579b321c62462e155ccc0b750e43
MD5 23dee82d682cd8f1c2e6986c7e83787b
SHA1 8332ff5ba13c2ba213a9da5f684d143f77105f57
SHA512 8314c22f69eb19d92b3bca0696b28b2b57d8dadccb8195856d9d0ac6cfcc60b6b75782036b24a94462ad6c02043925b4cfcee1d6a6523833cb8280076c38b17e
SSDEEP 3072:YEGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Ynm7Rkm1tYpBeh2BAom
TLSH
T1D3C3123B5D74E8375DB9BB1EB08E0B1F1EF14AA6C920DE52C8D46A0437EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download