hxxps://www[.]eventcreate[.]com/e/pacspa

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.eventcreate.com/e/pacspa
Sample260706-p3ccnsfv3x

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5928	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278158719962704"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
264	chrome.exe
264	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe
Token: SeShutdownPrivilege	4876	chrome.exe
Token: SeCreatePagefilePrivilege	4876	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe
4876	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2044	4876	chrome.exe	88
PID 4876 wrote to memory of 5928	4876	chrome.exe	89
PID 4876 wrote to memory of 1368	4876	chrome.exe	90
PID 4876 wrote to memory of 1368	4876	chrome.exe	90
PID 4876 wrote to memory of 792	4876	chrome.exe	92
PID 4876 wrote to memory of 792	4876	chrome.exe	92
PID 4876 wrote to memory of 5664	4876	chrome.exe	93
PID 4876 wrote to memory of 1500	4876	chrome.exe	94
PID 4876 wrote to memory of 5664	4876	chrome.exe	93
PID 4876 wrote to memory of 1500	4876	chrome.exe	94
PID 4876 wrote to memory of 3936	4876	chrome.exe	95
PID 4876 wrote to memory of 2968	4876	chrome.exe	97
PID 4876 wrote to memory of 2968	4876	chrome.exe	97
PID 4876 wrote to memory of 2864	4876	chrome.exe	98
PID 4876 wrote to memory of 2864	4876	chrome.exe	98
PID 4876 wrote to memory of 4904	4876	chrome.exe	99
PID 4876 wrote to memory of 4904	4876	chrome.exe	99
PID 4876 wrote to memory of 4340	4876	chrome.exe	100
PID 4876 wrote to memory of 4340	4876	chrome.exe	100
PID 4876 wrote to memory of 2500	4876	chrome.exe	102
PID 4876 wrote to memory of 2500	4876	chrome.exe	102
PID 4876 wrote to memory of 1612	4876	chrome.exe	103
PID 4876 wrote to memory of 1612	4876	chrome.exe	103
PID 4876 wrote to memory of 1992	4876	chrome.exe	105
PID 4876 wrote to memory of 1992	4876	chrome.exe	105
PID 4876 wrote to memory of 1260	4876	chrome.exe	107
PID 4876 wrote to memory of 5932	4876	chrome.exe	108
PID 4876 wrote to memory of 2280	4876	chrome.exe	109
PID 4876 wrote to memory of 264	4876	chrome.exe	110

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.eventcreate.com/e/pacspa
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbd2cec728,0x7ffbd2cec734,0x7ffbd2cec740
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1896,i,9575148473977180455,1622333323348115271,524288 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=2016 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,6170794823908254667,16093988127410636681,262144 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,13026831523557221529,11908889858835426805,524288 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,2778693754467859824,17837260214432553464,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,5024753354251781731,3173092842448217732,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=it --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,2818736741368169755,12064203180614325989,524288 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5236 /prefetch:14
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5584,i,12944132333774053500,6317473437266115707,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5620,i,16434567429501988470,4846149251724172042,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5576,i,4307703022446766788,6304659380360124210,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4972,i,188720688800231275,14984238894605931500,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4932,i,844832391087942620,827537171350022034,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6128,i,11571109645766214552,9984153554000271526,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6360,i,9347863030682234256,11579533520527747184,2097152 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,13447700975821366852,9216073980413947336,524288 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=6476 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4964,i,6454478485693678901,16944305063683829912,524288 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=6212 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=it --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,13144481959470778833,14642657554912477777,524288 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4828,i,16148585062002519166,11663199514244072506,262144 --field-trial-handle=1988,i,18162067580600884255,7846495861425278982,262144 --variations-seed-version=20260628-030030.229000-production --mojo-platform-channel-handle=5780 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 a4a93c2247374ea918a645daf115949d56e2d033cd84bc4758b4a40e605a5445
MD5 11002cd791ad57f5de62513dfcbf3c98
SHA1 0f04c2261465a34f22bb16f349840fb33edce934
SHA512 a75f5e0a6e4f0e4c1d426138ef37d709566c4cf1e1adb4bd518f3f94df8e01cf2a0d36a23bd77d1948bc8cb26b9bf2b5d2e5fc54c25e54f49f73c3639ccd0b4c
TLSH
T10AF02DBAC821EC3718FC571C61A41B47E750135B2780995B3B3D420C4FB563B468986C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 c562990a9a7a946deee74ca10d072bc5e9e942d819f9ea1a6d4f62ae23010e8c
MD5 3e473f96cd9e03fb2bc32ba8605e0152
SHA1 84d0e475d21b757665719dd640a664ad510a1649
SHA512 4a02eed30708f43c6c78737f0ec744391d97d045a34bb6c359c3f368abb5f0dad010f4850686d6d3b4576fa734b30df8494b896e23474408e9ed4363ed74cb46
TLSH
T1F8D0A9007AE014C0EB8127B728C08D85323E08FA7E32971BE8E0C5AC80F3391528C78E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ee3682e1911fd29aa4e0550622e34a89e4367283262dc731e1fa5df8d2af2fad
MD5 52fd058dd384c4b8cfa6b475276da788
SHA1 8782524623411480b6b07802a97011c3097e7e32
SHA512 9bfbaf5f8f883cf2214aba8f2d48c9a411ab035cae58e8968f1a2444956ccf95633f094c73d7d6b73ef4febbdd6406166277882964a723ab1aede2bbffa4500c
TLSH
T1B4416AFBC3D889BD891156F8EB152E1BCDAD0E15531C3C56C8D4EE5B53E5872D20014E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6708b699e2d94370f17404c96d42341617cb282fd1705ab2361c84b1ade52f88
MD5 561303a067a03e6e0822dd72870f79dc
SHA1 25d25c812e09c1ef86cea161d21decdc4ec2e835
SHA512 3c5be02b75cee295b5a366cd825e471bec2bfe7867168e8a74497ee5ff1ca010e465c86d53dcc59f54d37ffa55c7ea0efe37b917ba3df115f60af9686c9a26d4
SSDEEP 48:YALljajePjoPjlh6saRsxXLsffoKs7Xfseos3GKsrNCs9kzsHRipN7sfSglsnTsN:D2aExqyGWXrnGtN3TipNWVcqKnK
TLSH
T1BFA169F7C7E8866D881152F5EB15BE2FCE6D0954922C3C2AC8D4AF8B93E2461D20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b20db1ddc137218e5b3472b1797f9a4a8fbfb4874c3fafb431a6f3782adfd3b6
MD5 76f80ae78b0d51e43724cfa3047238fc
SHA1 f67a2af1650371072795fa847d3f9d768437417d
SHA512 b200e7e99987ce12806454d3b3d53d50d7b174e058a120d31b3e384be580a9fbc9c3b31ee65c29c0150f64968f65693a6fa5f273019aad2a3a9713d9ee459706
SSDEEP 192:1RELtNkFezv7QvAPRp22a9e3Hsb+WNng+W4An21XLeq2+RVyIsnAUge:1RkEELc6XGwXw2v292me
TLSH
T13532A42EAA14797B5CCFC21DFE6177A3D6F5102161D42E84EAFC892C16EB5CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c0c6a30a2db059e41084c24f6c9d9804e8de792b70c759d22f00456bc1b1934d
MD5 174cb9cb0cd29c5fa6b631caa0e8d326
SHA1 11802be33d9ef80cb6edc8a2b1e6d4189f104bbe
SHA512 84a343055249bd6755e530c20ddd25f16fdac184caaa90df2ded4788c1d195e3ea8e0fe5565ddd1a5fa90d8160fe7585d3c32cf7170d3cff5d46b360e54e6bbd
SSDEEP 192:1RELtNkFezv7Qv7PRpo2a9e3Hsb+WNng+W4An2XtXLeq2+bVyIsnAUgE:1RkEELcLXYwXw2v2XV2+E
TLSH
T1BC42B62EA914797B5CCFD21DFD617B63D6F5102161D02E84EAFC8A2C16EB6CC221742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 b7ca537e52b63b6b5e365a669f9fe87debcdb71c9daa7aacd612d0296c4629b2
MD5 eef72ffcaeacd271b4bba3da97a3d03e
SHA1 b36b6cfcf63d9d9a71ecf30af2714bb5343ee237
SHA512 adf7c6cd9be67d1e794ff6facc0f8014ea078f5b3bc8764b3ef53be43784453c22b1b10ace64db9d3fa4cd20b409875b41c43762ce3318b94b203473565dcad6
SSDEEP 192:eTI4K6xh7KxkXqK4I40pUZNCgVLHrKHfFKslEAL5XzKD/m5+ErUkKN9ZyxQGhAjB:CIjOh7KxkXqKf/pUZNCgVLH2Hfgsl95Y
TLSH
T17D32F927A58D5E3B4FD8D50CCC136F8BADF5019666280D2856FF9C0803A938E215A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 9099680686e32f9ff081c551401205afe328b30dc9f34e32fd58976a8bc582b3
MD5 ab93ba05036e6975fe28e1b7e1e6fee0
SHA1 a1a99d2caff67a543fe7dc3a618b19192f74b611
SHA512 25e033aece9fa3d97c362c677725d581c931eca48b0da3042b7cd9f04120bf6c18508359f52cb670f23ba24eceeb7510158854328e25bd3b66d267ac145f286b
SSDEEP 3072:HF1Y9+3NOxiWmLTKT8SIv0RPizlDEMRyMqS539:HPYoOxqLuT6cPiBDEMRISn
TLSH
T117C3121BC0D6698E539BDFB9F02A9A529DA48237C549BF24F7E14F06CEDF88E1114207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 173KB
SHA256 12ed24a229c2d02e1987c669218e6060e5b512d6ccab2645a34436f5620c0b9d
MD5 9ecce518f6f8f583fdcd6ba8dfde155e
SHA1 3a72e3492ea17c0812a206a306ebef5e24584281
SHA512 6568de5e39df14a57c0a51f6380dc71fe2073ce3e83a1d55a27bc230703eecd5a239bdc1ac15c955eedf5fee1561192a3eeb458e4af77c816a94bd7a4895b706
SSDEEP 3072:ypWdz9XNm9GuN8x60LRiES1Y9+3NOxiWmLTKT8SIv0RPizlDEMRyMqS539:y0xtNYlB0YE8YoOxqLuT6cPiBDEMRISn
TLSH
T18B041387C4D94D8F86BFEAADF0171A660C98413FA90E7F18FB908F8749DFD895218506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 4be1d9c3d1e2de8f38c41e0912647682c202ad366156882b4fe873cd9958c61f
MD5 f5bcf3c3f62b857444d0dd970862c3ba
SHA1 9c475a21fb68e91a9e70dfa1577e7cf33263e4f3
SHA512 24d19ff1c5fc2d2d32c29f706d24858aab893189ab1856b96941cc11e465a8bb1dce9a27f17a83eca562ecd9f2e2208990364469ca10c09664ce4dfaaf7ed04a
SSDEEP 3072:H/1Y9+3NOxiWmLTKT8SIv0RPizlDEMRyMqS539:HdYoOxqLuT6cPiBDEMRISn
TLSH
T1FDC3120BC0D6698E429BDFBAF02E9A529DA58237C109BE58F3E54F06CDDFC8E1110607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 a6f6406144aef35bcaae9723aa18df454db2c42ee3d50c0672de24b4b11563dc
MD5 5f92d933bc1911c007b5964c6658cf2f
SHA1 898611025cf731cdc70ceb56bb7c946112789928
SHA512 77b3e9c73f53fff2d84257d39d85985ceafdabebb5a52dcf2cb41a54bda92538161371c87b8b522319ff257300298e97b03917c77f1657bcd38b85c9a7ac94e9
SSDEEP 3072:yF1Y9+3NOxiWmLTKT8SIv0RPizlDEMRyMqS539:yPYoOxqLuT6cPiBDEMRISn
TLSH
T131C3121BC0D6698E539BEFB9F02A99529DA48237C549BF24F7E14F068EDF88E1114207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download