hxxps://www[.]facebook[.]com/profile[.]php?id=61590645778502

Analysis

user interaction
yes
max time kernel
18s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 07:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.facebook.com/profile.php?id=61590645778502
Sample260706-hvb9dae14m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3152	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277949948587429"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3524	chrome.exe
3524	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe
Token: SeShutdownPrivilege	3524	chrome.exe
Token: SeCreatePagefilePrivilege	3524	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe
3524	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4736	3524	chrome.exe	86
PID 3524 wrote to memory of 2520	3524	chrome.exe	87
PID 3524 wrote to memory of 2520	3524	chrome.exe	87
PID 3524 wrote to memory of 3152	3524	chrome.exe	89
PID 3524 wrote to memory of 4748	3524	chrome.exe	90
PID 3524 wrote to memory of 4748	3524	chrome.exe	90
PID 3524 wrote to memory of 1216	3524	chrome.exe	91
PID 3524 wrote to memory of 1272	3524	chrome.exe	92
PID 3524 wrote to memory of 1216	3524	chrome.exe	91
PID 3524 wrote to memory of 1272	3524	chrome.exe	92
PID 3524 wrote to memory of 3216	3524	chrome.exe	93
PID 3524 wrote to memory of 3216	3524	chrome.exe	93
PID 3524 wrote to memory of 3844	3524	chrome.exe	94
PID 3524 wrote to memory of 3844	3524	chrome.exe	94
PID 3524 wrote to memory of 5104	3524	chrome.exe	95
PID 3524 wrote to memory of 5104	3524	chrome.exe	95
PID 3524 wrote to memory of 752	3524	chrome.exe	98

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.facebook.com/profile.php?id=61590645778502
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff915ddc728,0x7ff915ddc734,0x7ff915ddc740
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,5545006895017230791,4363168680886320850,262144 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,17367529297560732316,14238575560739844001,524288 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1900 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,6151372015257599331,4902282479100283776,524288 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1880 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3168,i,2993054705830098361,9359084807460505816,2097152 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,13426331156253424833,11146846474163471066,2097152 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,3908079072641485736,7859434685090356628,2097152 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4488,i,12390348095857893463,3286509255628136187,2097152 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,17325688397631692884,18004203547538959608,524288 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,7688993002644826983,5354465357690495479,524288 --field-trial-handle=1936,i,13913331665720818884,16050179067399283206,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 97f1fe8b27ddcbe09a9e1f84690d03aa394f28c8a7f63c7dc9a906cab99d9c14
MD5 477e4ae196dcc86174e2d05d6dd23e42
SHA1 20fa6c5cc5efaae9ea231dcd97583f65925a364b
SHA512 b6f47171608f473a994eb43660f859bb8f0b647797594e9df9636f07b471cb66d14abedfb527fe7e5c1b93b8756347cdd561c03dcaa91edff8f39c7ffe2a1140
TLSH
T1E3E02BAAC832EC775CFD475D9494478AEA91135B2B60845B373C810CCFB16770585C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f5e61be66986935a9a9a0c11c0d9dd2e048c5c932f28c4d53f51c78dcfffc1f3
MD5 d0c877ad3d2bccc87283bf9bd97f9f0f
SHA1 9634084bfffcdbbd94439db55b0f357f800d3bae
SHA512 7c66536650f757377afd0138da710a72eaa3e7b03636e6d16c337251eac0bc0b6ede9247b4071dbc1daef013a73a09be922bbb53c9e6b7ee9da94c2d74fa5347
SSDEEP 192:IRY38/t8GSuv7ApAPRp2FUn9q5CHsb+WNn8HST421kf/2i6kwJzVyIsnAUge:IRY38gKkUXLLwUN2qf/2i63e
TLSH
T11042C87FE924697B9CDAC229FD127727E7F1102535902E84EAFC8A2C16E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ec5d012ae79d24618895c6b92ddb6b79ceac264fa993e6981f8928a73673fe1f
MD5 0c197a2afb83fc6e5ebb184df7ee5088
SHA1 a3fbcbd15f85022cc904812c5d3a5c3b8ee0a838
SHA512 53727dc8995a7bf78b817b80a577d6adfa8aab0b60a11319b1af68b34ebf1b54528c9d81d9dd237220f15876ff016024b35d8aa2a6f08d7c24861883c7fe9666
SSDEEP 3072:jbGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:2m7Rkm1tYpBeh2BAog
TLSH
T1DCC3023B5D74A8375DB5AB1EB04E0B2F1EF149A7C920DE92C8D45B0423F97CD1A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b2df148459334778a6a5ad8aafe7344a547ebd4247a2c8f18d2434b53b207eb0
MD5 e7dcd521d012e583df17ad4e6009915c
SHA1 3cbe2eab76415acd0e4ddc9e6259e9a437879d76
SHA512 a2e5f3c2ff4961af4abac9073e082dc52403d61f5d9add30135c2cbfda14c33db705054bbe119a57b91d9d252a7852a64692a32204ef6434546bf038e8900abf
SSDEEP 3072:AMGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:8m7Rkm1tYpBeh2BAog
TLSH
T17CC3023B5D75E83B9CB5A74EB08E0B1E2EF149A6C930DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download