hxxps://www[.]facebook[.]com/n/?events_invite_off_fb%2Fsingle_invite%2F2104516350443882%2F&sig=Tm-9MeDYVvZDkjtKoOgEnJ7RJ_jslbNpE6O733RHhxo&nid=nid&surface=email&mibextid&aref=1783344358856518&medium=email&mid=HMTc4MzM0MzEyNDI4ODYyODp0YXlsb3Jhc2h0b245NSVjYXJ0ZXJwYnVuc2tlbGh1QGdteC5kZTo5Mjc&n_m=taylorashton95%25carterpbunskelhu%40gmx[.]de&n_sg=Q6bPBAIbvxxN_YlphCdI8DBEJZzt1SvKZS3VOEzG-lhzlPgC-Q&rms=v2&irms=1&lfes=1&action=going

Analysis

max time kernel
299s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.facebook.com/n/?events_invite_off_fb%2Fsingle_invite%2F2104516350443882%2F&sig=Tm-9MeDYVvZDkjtKoOgEnJ7RJ_jslbNpE6O733RHhxo&nid=nid&surface=email&mibextid&aref=1783344358856518&medium=email&mid=HMTc4MzM0MzEyNDI4ODYyODp0YXlsb3Jhc2h0b245NSVjYXJ0ZXJwYnVuc2tlbGh1QGdteC5kZTo5Mjc&n_m=taylorashton95%25carterpbunskelhu%40gmx.de&n_sg=Q6bPBAIbvxxN_YlphCdI8DBEJZzt1SvKZS3VOEzG-lhzlPgC-Q&rms=v2&irms=1&lfes=1&action=going
Sample260707-at25eaev31

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2656	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278578718984669"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
3140	chrome.exe
3140	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe
Token: SeShutdownPrivilege	1236	chrome.exe
Token: SeCreatePagefilePrivilege	1236	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe
1236	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3020	1236	chrome.exe	86
PID 1236 wrote to memory of 2656	1236	chrome.exe	87
PID 1236 wrote to memory of 5056	1236	chrome.exe	88
PID 1236 wrote to memory of 5056	1236	chrome.exe	88
PID 1236 wrote to memory of 3032	1236	chrome.exe	89
PID 1236 wrote to memory of 3032	1236	chrome.exe	89
PID 1236 wrote to memory of 1428	1236	chrome.exe	91
PID 1236 wrote to memory of 4888	1236	chrome.exe	92
PID 1236 wrote to memory of 1428	1236	chrome.exe	91
PID 1236 wrote to memory of 4888	1236	chrome.exe	92
PID 1236 wrote to memory of 1952	1236	chrome.exe	93
PID 1236 wrote to memory of 1952	1236	chrome.exe	93
PID 1236 wrote to memory of 3768	1236	chrome.exe	94
PID 1236 wrote to memory of 3768	1236	chrome.exe	94
PID 1236 wrote to memory of 4616	1236	chrome.exe	99
PID 1236 wrote to memory of 640	1236	chrome.exe	115
PID 1236 wrote to memory of 556	1236	chrome.exe	116
PID 1236 wrote to memory of 3112	1236	chrome.exe	117
PID 1236 wrote to memory of 3140	1236	chrome.exe	121
PID 1236 wrote to memory of 4832	1236	chrome.exe	128
PID 1236 wrote to memory of 4832	1236	chrome.exe	128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.facebook.com/n/?events_invite_off_fb%2Fsingle_invite%2F2104516350443882%2F&sig=Tm-9MeDYVvZDkjtKoOgEnJ7RJ_jslbNpE6O733RHhxo&nid=nid&surface=email&mibextid&aref=1783344358856518&medium=email&mid=HMTc4MzM0MzEyNDI4ODYyODp0YXlsb3Jhc2h0b245NSVjYXJ0ZXJwYnVuc2tlbGh1QGdteC5kZTo5Mjc&n_m=taylorashton95%25carterpbunskelhu%40gmx.de&n_sg=Q6bPBAIbvxxN_YlphCdI8DBEJZzt1SvKZS3VOEzG-lhzlPgC-Q&rms=v2&irms=1&lfes=1&action=going
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff4ea0c728,0x7fff4ea0c734,0x7fff4ea0c740
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,8876452710325143302,14539552786687327967,524288 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1768,i,4249474736250609895,7240496598676956818,262144 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,5453541380647212354,854897731660233634,524288 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,9717367431411963577,919229573838884425,2097152 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,15813875232168551245,2387415675894922765,2097152 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,6460144169670555959,4515065735885903676,2097152 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,16402223373021751386,1471518246314902044,2097152 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,1762170032388166351,15552787051409457876,524288 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,5827301198317803069,13259728738414235808,524288 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5924,i,6427196844035729903,7618662221294799959,524288 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,10640115692100895583,5627243447412166473,524288 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4440,i,3865095716413624078,4545095273804579089,262144 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3224,i,9972928650659989511,3941471777776504660,524288 --field-trial-handle=2148,i,13584927496418067675,17768672236891839279,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:4832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e45091e6b3ddb2991dafb4552658a29f80843792d8016c9ea52d16f84841a797
MD5 b28516415548ac2badb280b42a1b6da4
SHA1 651d89e970905ec282a21cc1b3d5a435d8dd7368
SHA512 7e719191d3d1ec8356f0fbff5a0ff23bfa023106465a9ebaa34586447c89b120118a3582aa5416ed6eb5b5236452b96afad372d64cac2da4e3a3d32b91f315e1
TLSH
T1FCE02BAAC921FC371CFD472D60540645EA5017571760995F373C914C8FB16770185D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 facf03b2073528ea91ac0fe3e877fbfc92c0ddec3d591c95efb72c87bef8cc78
MD5 7ec40370abba641c3e4089705e219456
SHA1 1ee89edb37841731ca60d5661c97fb4bc6322465
SHA512 6ae20a22ab803ee8b15ca68454f31450905c892c853c43d2a0cdc4d7ac36dbc307e44516ff2677cfb05acefccaab776c8f98dcf8629a2cd4c98a6a03409c8347
TLSH
T15121D67F4FC028F0DBA4103121EB0888797008A7D0FB4FAAA918D47E5173B8629BD281
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 83c56e3035b8b2b2ef8a02377176e2f12e1a3d6ea3114a13a9d1ff011fd13fd5
MD5 18fc6c834d082a587f91b78401a043f2
SHA1 2ddac53fac89c279ff33e373522f1f69d55da167
SHA512 81a5de2d421c92e8ffa795ae04f88ea93452e0b640ff85849d090edcc01899bb6a516221b1c64d216c5fb0d810d5d7a6426c646879e140fa5fde417d5bed7f78
TLSH
T148619CF783E4963D9D1192F4AB253E2FCE290924531C3CAAC8D5AF5B93E2471E100B4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0a32c7cb4093938698cfba1587dc53e457b6266a9528db844cc20278a663a05d
MD5 d8ac4b04b36c0ee8039f4d821885e719
SHA1 99c3bcff46f76eb51fc033644453003ddd076942
SHA512 2ea5a356a178bcf4d73969a2dc55f0cbad9357dd26e179136424d51f044811d6955089e9bdfd0fbc75fdf1b63edf31f650552bb19cd9db7ba8d275940bcf709d
TLSH
T1DE71ADF787E4863D9D1192F4AB153E2FCE290924532C3C6AC8D4AF5B93E2471E100B8E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4bfddd5ec70b97a5688042b036e98ad6c9aa75ea4f61efa32c8cf3bbb1fa73c8
MD5 64ce48b469796a48996757619e547b76
SHA1 1ede625a8b3a9010ad1d7c8d50da6932afd11e53
SHA512 4928709cb3cd72848bebbe2c08aa21c56eab6e8a876e0cfe11c3cc1c884ef6d49642eebd565648df0f3e999cfb0da13d17281482574393e73fa5904e17b13ded
SSDEEP 192:IRL2IH2O98cpEv7ApZPRpzeI/UjYl9q59cHsb+WNnUCSipr2pIXCkwB4VyIsnAU3:IRL2POVgkTXyjYfwph2iXCGE
TLSH
T11652D82FFD105A7BACEAC629F9167713E7F1202965D42E84E6FC8A2C15D75CC211702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ca8d399eea52f5e36b88796c82049962005d85433362f5a1d135b1a518f0ca10
MD5 591517c9e6f16f6173ede56e1804b30b
SHA1 f6310b78f04f6730d071b332633e86a6feec88e4
SHA512 830375a2aa583aae4a1945ee9b099b63bca13584671cca3764d0a3479a8c529294eb90e24cffe3ad7febb08624f71a0e5a65d188a0176bbf2551e42f4bfb156f
SSDEEP 192:IRL2/2O98cpEv7ApAPRp2eI/UjYl9q59cHsb+WNnUCSipr2IIXCkwBdVyIsnAUge:IRL2eOVgkUXxjYfwph23XC1e
TLSH
T14152C92EFE145A7B9CEBC229F9267713E7F2202965D42E84D6FC8A2C15D75CC211702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 71ffe31a833219c9fb5622082fbe9cec2791c768a0d7bb745ce54aecf36f009d
MD5 87342375c4b0355131ab0e0d833e89f1
SHA1 bd3d3f928479caaa1f82687cf1856160683304d2
SHA512 4140e9744c3eee730d9f5a0dc3ab3f35e2b093b6e77fb26a3c003cf6260bb7e1a11664aab00555e47e09beb54514fbaca63bc1669c0afd6c5c88e5285eab2fbe
TLSH
T138B012D1C0116206C04202F411475488F128AF10D60E2F0243E06922DC2959080145A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591524.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591524.TMP
Size 96B
SHA256 c238148daa85913dcccf8d7896e8653ff0b1cf1ade6dad97ac53f53c1bd75d86
MD5 0407016424744563bb37c6538c05a9b3
SHA1 0aa6a5e99c2aab0ba344e1f7285559c49c8518fb
SHA512 5261426af062a3de013b146eb2cb09635556a29e904701ccd5752b8561fe3e226834e618e6ce60833c5d76111408cb8959fe46fba76e29dacecbd0bd3d1572cb
TLSH
T1D3B00265C2066252C44203B83A9795D97160DF35CA53321696E52A66DD257708535570
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 525999df53de0e07a2112f6cf62259aeb699217cf21ef8bab977ace5dc160381
MD5 7997a1ec9f62d66cf01a92d5ebf2419a
SHA1 2350f405205a4f15b72d193157f98ef63aed0e2b
SHA512 7834de34825aef09e15c6b563b7fdde492a8a0bfcd060d2484c225f11302790c6606eb3dd4edc5f43438b70d1cdb7457de3fe62db3313363c9413cbdf1f64ade
SSDEEP 3072:tjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Am7Rkm1tYpBeh2BAog
TLSH
T18DC3123B5D64E8375DB5BB1EB04E0B1F1EF149A7C924DE92C8D85B0423EA7CD0A44A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 26f7000ce05ab55523c5740e152f58b5b932f3e215659d2e6a938dcb693855d3
MD5 cd4ecbb6809cb36629469127623e3fbf
SHA1 0d0ab2aec223fdd72b731c2fc25c939dd7c28e0c
SHA512 62cb334e305166d2f5742c6bc2b1ad5b2b0358504328388e39ef2226fac4d357050afdc5c7b7757de7136e17a149bb3a66c8a1f007422803e121d90b139c88c4
SSDEEP 3072:QkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:6m7Rkm1tYpBeh2BAog
TLSH
T1F6C3023B5D75A83798B5BB0EB04E0A1F1EF24AA7C924DE52C8D85A0423F97CD1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 6edef2efd4255fc7ce846d17d82cfbae214884161dc43ca5606b85c8e5a8ccc9
MD5 ae0644bd6ba9f6c9ecb80116e7f5f68d
SHA1 4925ffe3d217bfad276d122858dcd06e9705a761
SHA512 a92dabf02f2ac9905457e912313291a06044ffd64e3d10c4b667cb875e634d07d3dff8b7807a04599014983284d1ae74484bc527702ea2d77a2e9d9beb0f98df
SSDEEP 3072:QjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:vm7Rkm1tYpBeh2BAog
TLSH
T188C3123B5D64E9375DB5BB1EB04E0B1F1EF149A7C924DE92C8D85B0423EA7CD0A44A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 daf853c7665f7d4c6a15e860f7079753f8d64fc38fe50f689e05f33e98db9e79
MD5 b3f0074f693ce0bb77bbae7a9f2ff7da
SHA1 540d7f4e7a2f021b47b656b4cce64119aaa7b169
SHA512 4f9bb4915422132a863738bc147212f97bfd69304c9b574bd99c94f6778854c285e6d11a64fd923c50a09cd1d5756be0f0d6c45a20f2c6cc7b8f2a1afca8612f
SSDEEP 3072:0kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Gm7Rkm1tYpBeh2BAog
TLSH
T19FC3023B5D75A83798B5BB1FB04E0B1F1EF24AA7C924DE52C8D85A0423F97CD1A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 2074d2b751bb5ea2f0f54d96740657111f30853e0372a6a83c4cfbcc67e71327
MD5 be7be8bd53ffdf1f099c469f1b018a4e
SHA1 3c089f25d9b808bb008558ecee505ab49737f4be
SHA512 87bb5cca2fa411b10330d3dd56267dfc94e3fcb4501219e249cdaab90054b31f8611337505093c4d1c787b599b53e3b940d2ea22e4f000feb12ba2be86195ccc
SSDEEP 3072:ArGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Zm7Rkm1tYpBeh2BAog
TLSH
T1A3C3023B5D75ED3B5CB5A74EB08E0B1E2EF149A6C920DE9288D85A0437F97CD0A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download