hxxp://kleiunanzeigen[.]de

Analysis

user interaction
yes
max time kernel
300s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kleiunanzeigen.de
Sample260730-p6bkjsstfv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2632	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298897698698548"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
4104	chrome.exe
4104	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe
Token: SeShutdownPrivilege	460	chrome.exe
Token: SeCreatePagefilePrivilege	460	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe
460	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4508	460	chrome.exe	86
PID 460 wrote to memory of 868	460	chrome.exe	87
PID 460 wrote to memory of 868	460	chrome.exe	87
PID 460 wrote to memory of 2632	460	chrome.exe	88
PID 460 wrote to memory of 988	460	chrome.exe	89
PID 460 wrote to memory of 988	460	chrome.exe	89
PID 460 wrote to memory of 632	460	chrome.exe	90
PID 460 wrote to memory of 3756	460	chrome.exe	91
PID 460 wrote to memory of 632	460	chrome.exe	90
PID 460 wrote to memory of 3756	460	chrome.exe	91
PID 460 wrote to memory of 4124	460	chrome.exe	93
PID 460 wrote to memory of 4124	460	chrome.exe	93
PID 460 wrote to memory of 4060	460	chrome.exe	94
PID 460 wrote to memory of 4060	460	chrome.exe	94
PID 460 wrote to memory of 3044	460	chrome.exe	95
PID 460 wrote to memory of 756	460	chrome.exe	98
PID 460 wrote to memory of 756	460	chrome.exe	98
PID 460 wrote to memory of 2288	460	chrome.exe	106
PID 460 wrote to memory of 3400	460	chrome.exe	107
PID 460 wrote to memory of 4536	460	chrome.exe	108
PID 460 wrote to memory of 4472	460	chrome.exe	109
PID 460 wrote to memory of 4472	460	chrome.exe	109
PID 460 wrote to memory of 4380	460	chrome.exe	119
PID 460 wrote to memory of 4380	460	chrome.exe	119
PID 460 wrote to memory of 4104	460	chrome.exe	120
PID 460 wrote to memory of 2228	460	chrome.exe	124
PID 460 wrote to memory of 2228	460	chrome.exe	124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://kleiunanzeigen.de
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb8e8ec728,0x7ffb8e8ec734,0x7ffb8e8ec740
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,16379367052607422305,11423846955618048424,262144 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,590689754998002134,14008527444456237268,524288 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,9274650695337148533,17420684722233102494,524288 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2312 /prefetch:8
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,2394960392264525097,3009560983436333928,2097152 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,6125886596763803445,15697233650336861142,2097152 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,4863330184508945055,10334334872837877811,2097152 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4552,i,7675025009867468044,5752542211762218484,2097152 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,17913784531976783952,387965588520368572,524288 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5588,i,16574966759059294149,12826570218705852758,2097152 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,3128749327688275195,8302590080932121370,524288 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,7014725355169315610,13193444902785183881,524288 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5256,i,4004023579336743399,7981170713767387207,524288 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3416,i,3278272489262667067,9023429658010374485,2097152 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5504,i,10464603750486691642,9569954256267083350,2097152 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5672,i,2323688955025285413,16739101508951228929,262144 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,6768362380116803441,512619209541418139,524288 --field-trial-handle=2040,i,5617406323294412495,10342718335923418111,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:2228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 46e05ea0775fe13cccf8386b41c67d5236f04f9d86ee03d9b2719abaff3350eb
MD5 e54380ca8e7447ae1b091905e083d7ce
SHA1 9122bf678bf1afa802c964e8c751d1a67ab41417
SHA512 186d565dbb1c0c2414c70145cb7af51044fa7aa831e2e94543b287e8fd8b3f6fd09ac84db6b9bc55a4e53e6c77513138455b4601a2329bf312cca7dfb0aa114f
TLSH
T1F3E02BAADA76AC771DF9577CA0444786E64013573F50D94F3A3C8109CFB573B064681C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f541e7e79aa196d84b4c5b3b6f41c19f5d715c981759b0951ec570b4114259fb
MD5 14d1599303d05b45ec60df031076dab3
SHA1 7d07c93ae8c80f6b6632c3da6e705d480df4386d
SHA512 d4ef116f042e46c1512451eb9b09d770be208b4634d74a51be85d28c2a75e5f4850e89fe6af9bd7023f11ad1e619c29a988934d93ad19ea7220fc49e3808eed1
TLSH
T15F2178F793B4997E8A0092E4DA11AF1FCE790625131C78A289D4AD2B43F39B2D10478F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2c4f5a41c8c9cef91e61d505d96c2e3616ae75291ef9c34759e9f3407f4d7def
MD5 28d585c936f7a2636cf6f28b1a9fbbc4
SHA1 15d3d4d9254a19c96b48ec6918c2978f2c25a732
SHA512 9e5234f1b1dbedcdc63844aa68372d77858abaae69e9420dd52e22b9839c299637f87c5db5e7fc4bec721dc6c1d54f2f94057d52a0333dc922b61f1c93725831
SSDEEP 192:/Rb2xauv78pWPRpQhm9DHnqPb+WNnve+ko2FbeR9VyIsnAUgE:/Rb2wK4CXH5n8GK2iLE
TLSH
T1C542D82EAA115A7B5CDBE61AFD657B53D7F21022A1D01E80EBFC891C14E76CC321311B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f6ededdc6ef00ade7650ffbb059597da48602d3754d18140e52191a263daf235
MD5 38f338ef38531b612ecc35b6d40eaa25
SHA1 8a769f71ced544a1afb507e26a3f87f058036e3a
SHA512 8abc074b5f1c876eeab7d4233c841c1192836ea589c9a55d91a5d8a2df6f4ae3cd0db98bd48863181b75a19c3786b68f7e2d6460b2b329ada4c1d812c985a279
SSDEEP 192:/Rb2xaD3v78pAPRp2hm9DHnqPb+WNnve+ko2PbeRxVyIsnAUgE:/Rb2wDf4UXt5n8GK2EXE
TLSH
T16442C72EAA11693B6CDBE61AFD657B13D7F21022A1D51E80EBFC891C14D76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 179f1c6c797acceacb6bb0b6dd8488d7d95a11330e49c0089453e9de857e8cff
MD5 5c1ff42431634790aecf6b86d8e72a52
SHA1 003807067a703700804d67382c18b5d3c942b62e
SHA512 0cf0de189821412f81940881c1925e4f449409336abce369569d40ec9dd3c99abe211007dfc51faba38e00b50608a7cdc674cd6d75096e76eba8417e7f7c028a
SSDEEP 192:/Rb2xaxv78pAPRp2hm9DHnqDb+WNnveP4beReVyIsnAUge:/Rb2wh4UXt5nIGPFWe
TLSH
T13342D72EAA11693B6CDBD22AFD657B53D7F31022A1D52E80EAFC891C14D76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 da5cd190b0731e8c4b4910e45baf2ac58262e2894d34ec73a9df062e2eff2f9b
MD5 b553ff1e3f33a9e4a2eea07efae3be19
SHA1 094eaa763b0ce709e0403299d95db49fac73340e
SHA512 6a1ff3c8837d369841b086ced764fec3bd2576cdc66d04141ae1d87cce31a092e53b3c2ba37470a2d31b13aaa446c83ee9cb30d4cc804adc74fc3bc58a461e5e
SSDEEP 3072:xpGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:xIm7Rkm1tYpBeh2BAoO
TLSH
T1EEC3023B9D65A83759A9BB1AB04E0A1F1DF249A7C920DE42C8D46A0423FA7DC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 313ba60442597435fc468750936357fd49df3c9e2b4242c4338721c68b426b4f
MD5 86e0d450e94f432660e185f766164ce2
SHA1 42a9762da8d1e0d8e5b6599543701c2ebfdbc625
SHA512 e6ac9647bed04fe8f91740a1d9716d644b986dbb39952dbdf1d4b0427a695fa552ceeee5cf181c4f4c2d774b53895faee76353d4d1c8a7c430b5f75e132428e0
SSDEEP 3072:xjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:xam7Rkm1tYpBeh2BAoO
TLSH
T1EFC3123B6D65E8375DB9BB1EB04E0A1F1DF24DA6C930DE52C8D86B0423EA7CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 9cae46137ce25647fe482cb292d71d69586ab6710a2dc8febd89fa5354583cf0
MD5 be869fb0a266dac94d2dfeabe48dfe2a
SHA1 58031c550e8ee6300f204b4485a04443275ae05b
SHA512 f341223283b1bbcf9e3af1faab7eab93fa8d5b813c995640bde672894afc5699fc67f85c2b665f5f32dbb0014eb99778590ef5991d926767eda3c8d01885cd8a
SSDEEP 3072:xpGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:xIm7Rkm1tYpBeh2BAoO
TLSH
T1E1C3023B9D65E83759B9BB1EB04E0A1F1DF249A7C920DE42C8D46B0423FA7CC1A45A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 92b26978d20c2774885b4fd2eafd0c63b8187005bee4005968c5c08bd39e2952
MD5 38715a061e1ac6c4b573ee0b00e1e57d
SHA1 36cb9448eb0d45c0a9eeecf014dd85f35f34b30e
SHA512 5082b81e4e663f72129d61caccfb2b941b6022b67bb80c9f357ae072287c8144a1faf22e94d9289dbcc303dc3cfd6d8d4bbf33a304411cd23360b10b57275b80
SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:4m7Rkm1tYpBeh2BAoO
TLSH
T189C3123B5D65E9375979A71EB48E0B1E1EF24DA6C930DE4288D46B0433FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c5a1d484c14cab4edfa78d877368ee17269ec7090fee01be661a136188246fcf
MD5 e844ace6f1b281118612c95ce144a085
SHA1 c5ef692ab861be6c495e3ca3352ea5ac4edb2485
SHA512 289ad602ff7644e2bd8f4b733908f802d73ac1b58499c36814181537c101d218e1898318a49a97c80eb5f97df6c4a37d6f29e8596fa9ce19fd8def95edfc7607
SSDEEP 3072:UjGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Uam7Rkm1tYpBeh2BAoO
TLSH
T150C3123B6D65E8375DB9BB1EB04E0A1F1DF24DA6C930DE52C8D86B0423E97CC1A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download