hxxps://www[.]x[.]com/logout?redirect_after_logout=hxxps://c[.]gle/AGSJxQyciIcr5UCuvRK8m9_k084qF0z9PkpsGJRBzekjcRUhwQq1kYhcps7dwyu6khWyt840l41IWzNDFXc2b1U-JDqxNqZf_b8_ULnkdJy7CFn3yiEPzmbwa8PgaQqudJ9ixHjNpBd0Ers5LA

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.x.com/logout?redirect_after_logout=https://c.gle/AGSJxQyciIcr5UCuvRK8m9_k084qF0z9PkpsGJRBzekjcRUhwQq1kYhcps7dwyu6khWyt840l41IWzNDFXc2b1U-JDqxNqZf_b8_ULnkdJy7CFn3yiEPzmbwa8PgaQqudJ9ixHjNpBd0Ers5LA
Sample261102-3dq2esdx8v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
4584	chrome.exe
4584	chrome.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe
Token: SeShutdownPrivilege	3456	chrome.exe
Token: SeCreatePagefilePrivilege	3456	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe
3456	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 3160	3456	chrome.exe	85
PID 3456 wrote to memory of 3580	3456	chrome.exe	86
PID 3456 wrote to memory of 3580	3456	chrome.exe	86
PID 3456 wrote to memory of 4800	3456	chrome.exe	87
PID 3456 wrote to memory of 4360	3456	chrome.exe	88
PID 3456 wrote to memory of 4360	3456	chrome.exe	88
PID 3456 wrote to memory of 3464	3456	chrome.exe	90
PID 3456 wrote to memory of 2272	3456	chrome.exe	91
PID 3456 wrote to memory of 3464	3456	chrome.exe	90
PID 3456 wrote to memory of 2272	3456	chrome.exe	91
PID 3456 wrote to memory of 2784	3456	chrome.exe	92
PID 3456 wrote to memory of 2784	3456	chrome.exe	92
PID 3456 wrote to memory of 4892	3456	chrome.exe	95
PID 3456 wrote to memory of 4892	3456	chrome.exe	95
PID 3456 wrote to memory of 4792	3456	chrome.exe	96
PID 3456 wrote to memory of 4792	3456	chrome.exe	96
PID 3456 wrote to memory of 444	3456	chrome.exe	97
PID 3456 wrote to memory of 444	3456	chrome.exe	97
PID 3456 wrote to memory of 5024	3456	chrome.exe	100
PID 3456 wrote to memory of 4108	3456	chrome.exe	103
PID 3456 wrote to memory of 4108	3456	chrome.exe	103
PID 3456 wrote to memory of 4488	3456	chrome.exe	107
PID 3456 wrote to memory of 2544	3456	chrome.exe	108
PID 3456 wrote to memory of 3960	3456	chrome.exe	109
PID 3456 wrote to memory of 4584	3456	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.x.com/logout?redirect_after_logout=https://c.gle/AGSJxQyciIcr5UCuvRK8m9_k084qF0z9PkpsGJRBzekjcRUhwQq1kYhcps7dwyu6khWyt840l41IWzNDFXc2b1U-JDqxNqZf_b8_ULnkdJy7CFn3yiEPzmbwa8PgaQqudJ9ixHjNpBd0Ers5LA
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe53b6c728,0x7ffe53b6c734,0x7ffe53b6c740
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,685413887479114160,11217661279035416252,262144 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,5811538757187778382,9123325812350532966,524288 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,18228061047163907710,5132638880318679070,524288 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,5146443184624288993,13597970101117849183,2097152 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,9341494094748439170,2782522033273489162,2097152 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,2534921570272316468,4072908187763499674,2097152 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4728,i,11598805796166080853,15181675149318475722,2097152 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4896,i,12191341070776677990,16233768272953832068,2097152 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4860,i,8527023812826121662,16499172286073486085,2097152 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,15046916454657453402,10532093861828764224,524288 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5656,i,4492337729713469204,15305187698496684473,2097152 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,15391061082793749755,13692408475141940278,524288 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,4705054059896272823,5274634689649748315,524288 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,1907580358716066976,11049966536970559629,524288 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4468,i,14289161132254248994,344898730023655989,262144 --field-trial-handle=1948,i,5388908493673154514,12562020623339714582,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16855845-4667-4e94-aab7-65053181216e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\16855845-4667-4e94-aab7-65053181216e.tmp
Size 131KB
SHA256 611dc20ae5a63ccbd34c0f0fb4ba96889d3f3d31fe8275f44959409b5d4879a4
MD5 d9b62623f6d4c9c43720df12b2892de2
SHA1 51c6fc5ef7996766eb04ceeac0b7bc8be1610e64
SHA512 2959703a0b0658ca63e43939cdbcd82f1a4c6af8d48ec6881e058055f1c427e3543a7bf356abb12c6737982d0d2cd629ea544d57c6bb40397a26df9adda490d2
SSDEEP 3072:wO+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:wO+hFD+7t56OD9ZfSAppr2
TLSH
T1AAD312326A95D87B89FD6541F257A304DE626CED81DE3A0984465F8ED09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5866b683-b2b5-4731-8f71-7a697453668d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5866b683-b2b5-4731-8f71-7a697453668d.tmp
Size 131KB
SHA256 b71cafce61c51d86d33f1883f37c7ed9c0b478d81285e23e4a54db81558de998
MD5 1ef1d469fe315aef5127890442b1a3c4
SHA1 6b2ec81f2bb1c8d317dacbe972351d40c9a7811c
SHA512 759181958d134ffadc49ebf18a563a5a93c8174b408dba24cb06e39bc96e2727fbe5cee561ca07475adb0ba778318bfe3cbaeaa6b2059b88564eba22132cff1a
SSDEEP 3072:Uk+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:Uk+hFD+7t56OD9ZfSAppr2
TLSH
T1E7D31232A995DC7BC9FD6541F2476304DD626CEE81DE3A09844A5F8A909FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66070027-4742-4c31-97d0-34797ec7f2a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\66070027-4742-4c31-97d0-34797ec7f2a7.tmp
Size 131KB
SHA256 60571e93d65b170d7d1785a62874c637f0d1d4c3969986849b0057ba51717a02
MD5 e2adc9d6ffc973b58d7e55d85a09a66a
SHA1 dbecd59c2ec478a6c8e94db68e49e8b695e7fda1
SHA512 2daf0e01a1fc21efeb5bdb9c41fac99301b825583eeac0d2a9dab3d15acc485a31891dac21c39b6716582c9fa94f02db8ff15edd0feaacfa27649bd3ca203013
SSDEEP 3072:ZO+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:ZO+hFD+7t56OD9ZfSAppr2
TLSH
T15AD312326A95D87B89FD6541F257A304DE62ACED81DE3A0984464F8ED09FC4C07A3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04b564ef-2169-4366-9f67-4f8b801fbcdb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\04b564ef-2169-4366-9f67-4f8b801fbcdb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

0e18bcdd-5366-4ff6-b2dd-e556216fb834.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0e18bcdd-5366-4ff6-b2dd-e556216fb834.tmp
Size 13KB
SHA256 b7a19b79fcbded1a646d95746c063baa61446fa1215d9cf9a281d32a83aad466
MD5 9a6791edc5c8f0239242d14b704496cc
SHA1 4624b24c50209ac0f84732d1c925023a8f067810
SHA512 8fea42a66566e522e8a103005a283cb340e5a3a506bb28bddecf37ed74feaa09739cc5aeb7404f5bd6841e39833537b992bcafd1bcc6f22c9c1986d9ee3ca941
SSDEEP 192:eRIHnSfZ8Jv7+pAPRp2/S0k9THsb+WNK/PQ69i2Gg2wmFSSVyIsnAUge:eRIHFJaUXp9wHj2L2xhe
TLSH
T12152B72EBA10793B5CEBD229FA117B5BE7F6103564941E84EAFC893C18EB5CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a42fb00-dd64-4413-ba7e-e3e94dcc8cac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a42fb00-dd64-4413-ba7e-e3e94dcc8cac.tmp
Size 13KB
SHA256 1a5809e1a9b7c6c2debb78f9c65121d49be52ebf09ce0b6691e79476ba2b3880
MD5 9725b875211a19a3568c30768bb9fd0b
SHA1 4dec2b234ac97c0b000c785af68a570ea4c9e11c
SHA512 c679b35440d30100b2cca72bdbb9a7a7de9b29965ca673469cd1ce9d90477aebfe4419392c4d62a4ab40fd3098ca280795ed8ec337d3dcfc86877901b72461aa
SSDEEP 192:eRIHnSfZ8Dv7+pAPRp2/S0k9THsb+WNK/PQ69i2eg2wmFSbVyIsnAUgE:eRIHF7aUXp9wHj2D2xmE
TLSH
T16D52A62EBA10693B5CEBD229FA117B5BE7F6103564901E84EAFCC93C15EB5CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4af58cb8-5ea5-4d15-9bfa-5521617e8a0f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4af58cb8-5ea5-4d15-9bfa-5521617e8a0f.tmp
Size 17KB
SHA256 f7e0a7036b9bf87d18941afe0a0039bacd2a6a85b55115963a1d3bb3d3d25ed8
MD5 f5dea701d1a456a3a13710f824722a0b
SHA1 61f3bdb433c2dbd53fdfbd02fb2c0b467fc8f51a
SHA512 57ad41f970191f2aefbe4c358b9171c2932649453a5d90e4b2377a9c358a9d2f45247433f41a6836a315424d66459abb42a476e472641e65c9e0855795e04ac4
SSDEEP 384:nNjzO7KxkXqKf/pUZNCgVLH2HfgslYk7pLuLceSZkXODzq+ErU3yTHG3E5TZ64:nNzO7KxkXqKf/pUZNCgVLH2Hfgsik7p6
TLSH
T17A72F9A7BC4C9E3B4FE4C99CDC167B4FADB5024755E9886442FA582903C5BCB11062FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 077c0774f50afea3f1d444cde6eaf235b7951354a1f6e94af1f3200a11087592
MD5 316cdb5f9078150c9f89fadfeaa1915c
SHA1 b55c92bca66236ebdb34992bd34af25a633199d7
SHA512 aa925b350b031b49ccfcfc9d1092077d80bbdfe46572937f920bac737d8fd8156c867988df4c39c7c32f14ac5680edf9f942d935c0b9654df1f2676af51ca37e
TLSH
T193C092C1A288926FEFA21578EB5A68206229566A92025B52C5E5F0B1A1272E85920A11
MD5 SHA1 SHA512 TLSH

Submit Download

2781971d-5797-4447-ab04-dfce3d3ea223.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2781971d-5797-4447-ab04-dfce3d3ea223.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c984d8d5-b725-41a2-ae8c-4744d3e6f2b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c984d8d5-b725-41a2-ae8c-4744d3e6f2b1.tmp
Size 3KB
SHA256 c35d507832be8e1d2445cf7c9bc7e19e76d8817ea67151450853d356490fb50d
MD5 147ac3467bdbdc92765217550584503f
SHA1 4d4af0728d8671ec2639aa73b147b0d2c10a6a98
SHA512 6d75ebb75fb90d08a96f7553d89ca7e414a82218af4e88abbb05c88e1ec84d07ecef8267f45708a18e7a40cab6feaf8d9530299dacd0b9266578693051718d42
TLSH
T116818CF383F88A6E891196F0EB146F1FCE690569435C3C66C9D5AE0B93E2472E14174E
MD5 SHA1 SHA512 TLSH

Submit Download

d952495b-58d9-434d-a659-ad76caedbbf1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d952495b-58d9-434d-a659-ad76caedbbf1.tmp
Size 4KB
SHA256 0ac24206611a7501ee4f1d7358b734b491603835e173f0fc804a244318918f7a
MD5 5efaeafe1c6fd6b9bc79f4d66b8bfc5c
SHA1 bd4e6537275a0acb1d83b626ab125d326b1048d8
SHA512 db7690a9175f145af68f73dba7ffe1599c039123f9cd3293b1e60ab9224500c8fad67e301dbb6d5cc52f3a40406af59b9b461281fc261fb506c202417686e4bd
SSDEEP 48:YALlCXQbKElhLaXYfo7Ed7C6sT4sAgmgOBfRs2C+5s7bsGoJIMsN81sNxgrsX+sp:D5OKpaIaEd7iAiufVFEIJIJ8Ux5QTjhq
TLSH
T1BB917EF3C3F88A6E891196F0AB146E2FCE690529436C3C66C9D5AE0B93F2471D24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 f300c48baa30614cb14812ce943c88498339dfeb72ee7fbed4496e59e02eae81
MD5 7fac6a308f88e752bb9c180e195c6509
SHA1 a7c3cde6d7ce9227e18652a9f075757c86ff4999
SHA512 d473789e344a903a885c481529064a851be06d8f1a7339a10f8e9c32eae00a8dee79d65c5492067a896911777b7daa60cdd62e4e2b9b0c189e94036a91169f91
TLSH
T187B012848841D341C40303F81151148832E4DF39A605230941F00D12C835560902B174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 6078b55517efa107556ec3866446902c65cf8a01f37ac44ea386ae9a1a72982b
MD5 5a1f64e853fdfdd5a12f789cf49585e4
SHA1 9df49fa75beef0b28138330ef7bfab6eb56ee61d
SHA512 7f7429b22883dec39742a188d4df8b16da35627ae6773ba86dbde96decdee72dbbc28890fc53e3da24000adf722d8a0f870a2dce6a7dd9b82126c08e43104770
TLSH
T1BFB02200C2022332C00283B82A88A0E83020FF2AC2030203A3E08F22CC202B000380E0
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

cec93eb3-f7fa-4319-abb8-b91b4ea95918.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cec93eb3-f7fa-4319-abb8-b91b4ea95918.tmp
Size 13KB
SHA256 d221868f208dfa4086a4838c2db61f02157d05822f9f45ae4097334a771007df
MD5 18736fa2e82d5e81f26bba1fdf852e37
SHA1 6a28a434f88610987b73ff6767c53677e8506ac8
SHA512 d5d0aef8648c7c624769e0329270cb196c897fc794757840bb34733c24c70b2cf332bc6fe01f6c4e1085b5f1ab4788c893657c7ecd3f7584ec0fedb412e037a2
SSDEEP 192:eRIHbSfZ8Dv7+pkPRpS/S0k9THsb+WNK/PQ69i2Bg2wmFSPVyIsnAUgE:eRIHJ7acX19wHj2y2x4E
TLSH
T10752B72ABA10693B5CEBD229F9117B5BE7F6103564901E44EAFC893C18EB9CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4f43384-4bf7-4417-b674-18db3e5b8d85.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e4f43384-4bf7-4417-b674-18db3e5b8d85.tmp
Size 414B
SHA256 3fb7179dbad19aafd5700df382e65ad5041b2f07457bc17b6031946fd0fa4375
MD5 cac910dda1223190d151a601557ddecd
SHA1 47a51185a6c6afd3c6e409bf79a3ec9de6dbc04a
SHA512 82ae34c75922ebee3334df99a3a89aae9503e4fa6d0f93b2074ab4c350d4a1cad2751b55b84043d7f10edc3391dc8e691a12a54d1971c607ce7746baa3331c4d
TLSH
T1E0E0EDAAC922E82728FE0B5914614B5AEA4113562A41894B3B3D81188FB1B3702CA82C
MD5 SHA1 SHA512 TLSH

Submit Download

bf4b7e11-bab2-47a3-8c63-34c7e0bec66f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bf4b7e11-bab2-47a3-8c63-34c7e0bec66f.tmp
Size 130KB
SHA256 e8137ebcf2366132c6c24010ce63fe0c7e2c2508ce90291c7f7eafbbc3bf6588
MD5 4a42a43ca9b0479fe98bac71b553d382
SHA1 5a71387e23aff73cdc43abee256053d6d31e5f29
SHA512 1bc4401defa75234ab9dd664d86c92ee4ff0b8cc278d9a63509ac03bf1d8cdd13525d84ed66921193bcdd7626747c95c0cdf609e98059b3344737bc34a76dfad
SSDEEP 3072:9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g2:9+hFD+7t56OD9ZfSAppr2
TLSH
T1EBD312326A91D8BBC9BC6541B257A304DE726CED81DE3A09444A5F8ED09FC4D0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download