hxxps://url[.]usb[.]m[.]mimecastprotect[.]com/s/ojmECLAmQZCqw2WsBfDWhyLc-L?domain=evenium[.]events

Analysis

user interaction
yes
max time kernel
216s
max time network
221s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://url.usb.m.mimecastprotect.com/s/ojmECLAmQZCqw2WsBfDWhyLc-L?domain=evenium.events
Sample260806-ssnvhavake

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2096	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305034246531315"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
5284	chrome.exe
5284	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2012	2716	chrome.exe	80
PID 2716 wrote to memory of 3228	2716	chrome.exe	81
PID 2716 wrote to memory of 3228	2716	chrome.exe	81
PID 2716 wrote to memory of 2096	2716	chrome.exe	82
PID 2716 wrote to memory of 1364	2716	chrome.exe	84
PID 2716 wrote to memory of 1364	2716	chrome.exe	84
PID 2716 wrote to memory of 4788	2716	chrome.exe	85
PID 2716 wrote to memory of 4788	2716	chrome.exe	85
PID 2716 wrote to memory of 6124	2716	chrome.exe	86
PID 2716 wrote to memory of 6124	2716	chrome.exe	86
PID 2716 wrote to memory of 1812	2716	chrome.exe	87
PID 2716 wrote to memory of 1812	2716	chrome.exe	87
PID 2716 wrote to memory of 4404	2716	chrome.exe	89
PID 2716 wrote to memory of 4404	2716	chrome.exe	89
PID 2716 wrote to memory of 5172	2716	chrome.exe	90
PID 2716 wrote to memory of 4652	2716	chrome.exe	92
PID 2716 wrote to memory of 4652	2716	chrome.exe	92
PID 2716 wrote to memory of 2500	2716	chrome.exe	93
PID 2716 wrote to memory of 2500	2716	chrome.exe	93
PID 2716 wrote to memory of 5348	2716	chrome.exe	94
PID 2716 wrote to memory of 5348	2716	chrome.exe	94
PID 2716 wrote to memory of 2056	2716	chrome.exe	95
PID 2716 wrote to memory of 3928	2716	chrome.exe	96
PID 2716 wrote to memory of 2200	2716	chrome.exe	97
PID 2716 wrote to memory of 5284	2716	chrome.exe	98
PID 2716 wrote to memory of 5008	2716	chrome.exe	99
PID 2716 wrote to memory of 5008	2716	chrome.exe	99

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url.usb.m.mimecastprotect.com/s/ojmECLAmQZCqw2WsBfDWhyLc-L?domain=evenium.events
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb11fc728,0x7ffbb11fc734,0x7ffbb11fc740
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,6262202219612257808,14467976711292994639,262144 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,1095622558872024500,9769868667405862942,524288 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,5549407222148747145,18115626832321569307,524288 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2512 /prefetch:13
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,11330806019296519609,2077496617085397047,2097152 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,8766217272563059236,8067773449931936382,2097152 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4292,i,9703028049527949403,14586163055809850244,2097152 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,13938473765562782865,13869341163655899824,2097152 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5580,i,17687444362076979849,15574397519009528958,524288 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4892,i,9614151235545641630,12773767518121234694,2097152 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3276,i,13866767380156748188,15951276924253563036,2097152 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3444,i,5685191750654543957,1480578795442147330,2097152 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3068,i,2597605351682118349,11101814966467864735,524288 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:14
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,5428427162407063344,13298395955205094187,524288 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,11776733982530278926,2004398551366591502,524288 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4948,i,10448758468654682338,14984872836108651970,262144 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1076 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3956,i,8135738310764192213,15138628308247970535,524288 --field-trial-handle=1976,i,3995890263420847493,11674949983771836597,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:14
  2⤵
  PID:5008

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fc41bb08ab0ede7c1d659368f598c4b4034d8911565552fb4c4b6ba3c6d02812
MD5 d0d053e9424a62dcea0e41d3c0cb6e76
SHA1 a560dd3213d6b16ba3b508797f6c659046353409
SHA512 99de0ef0ac0978773c86ab306f5c32c4c07dc191f8d9eb99104716f6a96cfc4b5ea605f35f1bef7a1f12c18a1ae34e443ec650ec4eca394456919569a43e8036
TLSH
T14FE022AAC821FC270DFD2B2C6195074AE76103172F809A1B3F3C911C8FB1A3A418A91C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 7bcff84cc0e8d34ba0a507b27f3720353fa5912d2df2c032d6f68153755bf734
MD5 dd83ef29ed5f94dbba6da0b26a71b456
SHA1 1effa58a175f2ead1a7454d72eea4046fdc19b36
SHA512 1fdec5478902d55ab55f9d304ac781bd33720aa898a4d523fc6796600ea050ab8cb6a158013d848136aaa88745f73ba506fe827da6d0ad38d466df3135e121ef
TLSH
T1FAF0D82015A48999C70554F978E59C10F9710624689F7DB340E5B533CA0B3FBF0DA429
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 0c6eb86e8f3fc5cd90e4e69c9eb3311866ac48b88d2b7de9661b2ccb9dc9adaf
MD5 f7f0cfc87857e8e8cc547f06c0bbf68b
SHA1 dbac401518cb5e8229da64924f35995e87f6815c
SHA512 fe82148ba3116db5e841e3b78b252f71246860d41a69755cfc0e310ae73981b337917783964c4c9092ae647aa4b436c3b45babc8f3e88306adbf05453c9c1a23
SSDEEP 48:YALlhhJfBzaXYfo7EdKsFK4sFHVgmgWsBVjzsXDSY4tBMEsGHivYICsvQgCZsRha:DB5aIaEdLKF1il+DZ4tBMaHiAI1TCZOQ
TLSH
T1FF918CF783F4856E9A1196F4AB14AE1FCE690920136C3866C5D8AE1BD7F34B1E10178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7784cdf4b30634d36f38c254ef13f5a2ce29168e9766132bca761b1e80fa6fe8
MD5 4128145bb7727591c112248a8eee3494
SHA1 cd9baecd896cbd88069cc7872c794ee37dd9ba93
SHA512 46ff08354d98160b710cf8ae60b8677295dece89787639f5e6c7abd91e141c595db5cc42042fbea9ded8f0b72f62bb61d1e68e0b37e32f1d44f3a81ad3385512
SSDEEP 192:sRCbvillBo+9Uv7HpyPRpcNQPU69DHsb+WNONGmmzpMhv2Ai2iHaN8yIsnAUgE:sRCTClD9QjOXz5w2Yi2n2iDE
TLSH
T1CF520A2EA810293BADC7C725F9697B67E7F6103121D01E88E6FC9A2C15E76DD321301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b096ceec899f923235052c75da7c36e97536d24085c3c70f199c72b429bebf53
MD5 6652ccd7b0811251864720fd93253e9d
SHA1 41995a8670cbd3bb3204f28e89aa9b77253a8167
SHA512 4e4d77be053648a5eb25ef253a8afd315399386403064a030d23d877b9b7e8e3360828356de306d1ee8e3031e5d5c2bc56e06d8f87de2b37c26939b89ac2c8bb
SSDEEP 192:sRCbvillBo+9Xv7HpAPRp27P89DHsb+WNONGmmzp21i2iHaEVyIsnAUge:sRCTClD9/jUXX5w2Y242iZe
TLSH
T18042E82EA9102A3B6DC7C229FD697B57E7F6102121D02E88E6FC9A2C15E75DC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 985f43b0f4719ce9295b091fde9fc85b4d0ed6852935c2d855911153a2272e26
MD5 920d8967f1b2f7647b041a15d80d344c
SHA1 09dcd8e9f648bb6ed217f05c603e3f9fbe05f00d
SHA512 1343a54f15e54f990a31330a68ffc0babe3fda330211871ae9b81c03fb6c4ec020ba7ddba55d122f086d867b8f3a5c0128e41c1aa7cb3235c249898eb3381a05
SSDEEP 192:sRCbvillBo+9av7HpAPRp27PUW9DHsb+WNONGmmzp21i2iHaEVyIsnAUge:sRCTClD92jUXm5w2Y242iZe
TLSH
T1C152E72EA9142A3B6DC7C229F9697B57E7F6103121D02E88E6FC9A2C15D75DC321341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b427bb470ea6c2b0f5faf2963997d46aab3a961a090a9e0d33e0797a51318ab6
MD5 46301bea2ad3ebd409e3820cf94db181
SHA1 4054f7c6333bfc5874d8be4ce60631dd5dbad703
SHA512 201d83f19bd628f3f37c04fae4d438a8712a344944070aac1b2a61e5cbc2fe4ae1026c0b3c602b6aeddfb204f89515590c8aa7eaaaa716df1c431c4e61ada3a8
TLSH
T19EB0128088015201C40302F4524214C8B1549F10D68A1B4943E0792B9C29550C02C050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5878a6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5878a6.TMP
Size 96B
SHA256 c1db48f4286fd3cbdda0853679edb30cf36c094156c5ca5920337cc9f773ff36
MD5 941e64cd2b572db6716736444fbb1553
SHA1 0bb1afe7957547a199b5f7087ecc7013cb56c4c4
SHA512 3786a45ce4baa634b1530e81b2a6f84e3b824900e1d574b471a6d5599b02af4a95c4d678a2b15eebb6e34a8f3a9dd4c41750d9f5d4f40f311785637b0bcdfd8d
TLSH
T10BB02220C002B322C00303F82888CECCB3A0CF30C203020282E03A2ACC302A00220220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 a8c6a467282afb66f69def6fdf9d6e847689c9590c6b64b1a969dd24398f3ec4
MD5 bdf952821139296241884e901326e94b
SHA1 f78b68b70f7e89f4a2d1bc1fe482b46fd96e144a
SHA512 d65fa65975d1ad95138c68a67808ae6d4ca9b4f2f07b6222d19397e20399461793e3a456813977f40159f53db1c7a0d65944cc71289eaf5e19d5d01ef214adc1
SSDEEP 3072:RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Am7Rkm1tYpBeh2BAo+
TLSH
T11EC3122B5D75B87659B9BB0EB04E0B1F1EF149A6C930DE92C8D46F0423FA7CC1A45938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c3718750d8cdaef4c0447ab5fd7b4ca454d1d4b7f56b909c4ffb92295fa005d8
MD5 f109ed879abea57337980fb59ac7c33f
SHA1 f27e4764e4eaf8cbf4889e065add314f7cfeb8ca
SHA512 51d156b0163a5b7936f9aecf279a3c4c892e3b635be5cb73eb9515e592d5fae9d27cc5e7fc79ce32dcbd3c4932fd56274d5c77c10734c466ef04761e6a37bdbf
SSDEEP 3072:RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Am7Rkm1tYpBeh2BAo+
TLSH
T1ABC3122B5D75B87659B9BB0EB04E0B1F1EF149A6C930DE92C8D45F0423F97CC1A45938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 e96a8cc902c12b5ed9d98b0043173610b02e9ba95cfb9896176ee0cf5303cca0
MD5 a8f8399b6eceef6233f637539cb44749
SHA1 4b4bdf89cd84af4ca2a84ec3f78ab8a443aa2f40
SHA512 a712f95f4009aacbd3c686d6de6f2b03aa28eca492090c58ce3d13cefbb9bb16f975313b562038acf77fdca289ee1db4b57dacd02af2b1d2d65c90b49dc5a4f5
SSDEEP 3072:7GiGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:SVm7Rkm1tYpBeh2BAo+
TLSH
T1EBC3123B5D75A9375DF5BB0EB04E0A1F1EF249A7D920DE52C8D86E0423F66CC0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 cfe4ae02bc402b1540704c465d8bf45264b0a8727b48906e10a1c605a37bc78e
MD5 4f70c23286df4bb89242bf60793ac5d5
SHA1 d2f09af265c0ffcdd17097a208c6e7a3bee1fe00
SHA512 fced2aa2a25b74a6cefae90a2fbeef7678249eab976a87c845ba588bfa631b60d9bc761ef6ee317d570fed64a076be4e0564c1e2e71283ffd82b04500e1917ca
SSDEEP 3072:PGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:em7Rkm1tYpBeh2BAo+
TLSH
T1EDC3122B5D71A93658B5B74EB08E0B1F1EF14DA6C930DE92C8D86B0477F67CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f274dad07d7b76d424d55cbc5cf10b4265632662e871a7f6e4ad6e819b7bf16d
MD5 738f9d7ab672965bc73d93885f5263d1
SHA1 7af64618eacf5aec3d7a011f4b32fa71f4ae4982
SHA512 266665ab63e2fa754e7e6eb3dd7305d2f10eb9b8f93e22e4811d66dd0153cd4a04d27e8652f61eb0a7819a98e275d9f9361dfba3d9b5a121fd2a288d2f9589b1
SSDEEP 3072:0Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:3m7Rkm1tYpBeh2BAo+
TLSH
T19EC3122B5D75B87659B9BB0EB04E0B1F1EF149A6C930DE92C8D45F0423FA7CC1A45938
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 157KB
SHA256 6e3a5e8fc2197f35c384ec020acbefc208ce5099fc7aca87f140b9c7f6b4cc2f
MD5 1a8919bd67e1fa5fad099dfba2ee34d8
SHA1 fb7e6afbe18eba37571b7274d4b5b750da604219
SHA512 932a923210370bb4431bcbc6b45cb9b9006981c29437533142b2b054ed3e3c227262db6c4ecc76011cdb8c51db73f145d22790977b8442a77db8a064120877ad
SSDEEP 3072:TEQgajAnHf3zvs3qhtz01ZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:2a4/D0/1Ym7Rkm1tYpBeh2BAo+
TLSH
T1EAF3133A2DB17C795CF6AB1AB08E0B2F1DF25C5BAD149E96C8C45D40B2B57CD584AC30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download