c30402f0d15433e189504a9781e31c159363014882415921ae4d3a67b1fb813d

Analysis

user interaction
yes
max time kernel
109s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
free.html
Size 33KB
Sample260804-mf5platshw
SHA256 c30402f0d15433e189504a9781e31c159363014882415921ae4d3a67b1fb813d
MD5 5eb6d0e298855eaa6b950771ad0682f1
SHA1 64f5cd51b85064fd4e62826ade29cb4cf97602fa
SHA512 e5d718e8b0f8e248c3968a20b700c4f28cb804246d736f12e28c2653d2b2386c3343def02b6bc128663825c7e3c19a71c744f20d05592c5921742e91f0dd9035
SSDEEP 768:Jt6dGZr+QU13K+U14XDISbBALd5wFWOGorjrXEn7xoESLOMG7XE:Jt6yrjU13K+U1gzbBALHZOXrH09oESLt
TLSH
T146E20980D708FC157252498E60EF0C292254E9A37606DBA8FF91CDF6FBA59806427F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2756	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303127429601214"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe
Token: SeShutdownPrivilege	4464	chrome.exe
Token: SeCreatePagefilePrivilege	4464	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe
4464	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 5260	4464	chrome.exe	89
PID 4464 wrote to memory of 2668	4464	chrome.exe	90
PID 4464 wrote to memory of 2668	4464	chrome.exe	90
PID 4464 wrote to memory of 2756	4464	chrome.exe	91
PID 4464 wrote to memory of 2672	4464	chrome.exe	92
PID 4464 wrote to memory of 2672	4464	chrome.exe	92
PID 4464 wrote to memory of 1356	4464	chrome.exe	94
PID 4464 wrote to memory of 1356	4464	chrome.exe	94
PID 4464 wrote to memory of 5292	4464	chrome.exe	95
PID 4464 wrote to memory of 5292	4464	chrome.exe	95
PID 4464 wrote to memory of 3104	4464	chrome.exe	96
PID 4464 wrote to memory of 6056	4464	chrome.exe	97
PID 4464 wrote to memory of 6056	4464	chrome.exe	97
PID 4464 wrote to memory of 876	4464	chrome.exe	98
PID 4464 wrote to memory of 876	4464	chrome.exe	98
PID 4464 wrote to memory of 1948	4464	chrome.exe	102
PID 4464 wrote to memory of 2380	4464	chrome.exe	103
PID 4464 wrote to memory of 1948	4464	chrome.exe	102
PID 4464 wrote to memory of 2380	4464	chrome.exe	103
PID 4464 wrote to memory of 2548	4464	chrome.exe	104
PID 4464 wrote to memory of 2548	4464	chrome.exe	104
PID 4464 wrote to memory of 5276	4464	chrome.exe	105
PID 4464 wrote to memory of 5708	4464	chrome.exe	106
PID 4464 wrote to memory of 5708	4464	chrome.exe	106
PID 4464 wrote to memory of 5276	4464	chrome.exe	105
PID 4464 wrote to memory of 5284	4464	chrome.exe	107
PID 4464 wrote to memory of 5284	4464	chrome.exe	107
PID 4464 wrote to memory of 2656	4464	chrome.exe	109
PID 4464 wrote to memory of 2664	4464	chrome.exe	110
PID 4464 wrote to memory of 5852	4464	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\free.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf301c728,0x7ffcf301c734,0x7ffcf301c740
  2⤵
  PID:5260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1776,i,5721449230477281395,5438790138036514703,262144 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,14930501199882009167,3361635753882524620,524288 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,5546316731183500065,4534354968108204312,524288 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,7578066045723768488,4596977896921820499,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,6725513453047425754,5191192306512806443,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5168,i,11285357550207416649,17672684917107011153,524288 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5236,i,6372298981775344371,2456012518067620417,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5256,i,6313229854191951995,11969788159558878126,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5560,i,6671823875291863958,13485320506222725541,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5444,i,15031839402323160934,8718753539280222098,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,8679222454894890785,4898217039470904127,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5776,i,11350379573232413703,4875543784654981692,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5288,i,17319198690065786985,11121257378546814628,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6076,i,8266659881365891631,3186611657232677933,2097152 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,17114272287048884767,128773707805414686,524288 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,5005946404828096828,12031901949878868999,524288 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,16508464882560215587,6923145015560365943,524288 --field-trial-handle=1928,i,15489689232732351764,3374752720299393302,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:14
  2⤵
  PID:5852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bf378bb396be232f1a1a1e385481965ff077f37c55763cec838c99620e523d0a
MD5 315525641be630f76b4f7e5a59f2896e
SHA1 8e04507a981b75257114ccac336adfc97f3893cc
SHA512 f747d239b19f432a8e95502ac6b42c47bbbf2989d772b171f4d1a1b6c29555d2fd34255c76a8a979ef325b87bde8087387be7ec0416d2295ad294badca9a05c9
TLSH
T12F417BF7C7D8997D890556F4E7156E1BCE290E18432C3D26C8D4AE1F57E2872D20068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7e20b04060267740a9ff6e81515a2b38a02178c5f9608f5dcb107106d9b533ac
MD5 d3058526b2f85e8b74f007e06fb432d0
SHA1 23c2277f3da422d19b56a4a062d04506d6585ab3
SHA512 18b4f7a40f5d00c761b624c66c152509d2465eac5ea1fa2037feff75cde6246fed2a8f782a741989857a0c777072bc31862bb3c8ba3a52b8df29106ba918a32d
SSDEEP 192:5BRtNavLv7QvAPRp2Wh9XxHsb+WNnvePYu2okkwQ2VyIsnAUge:5BRtNez86XZfwGPL2NwOe
TLSH
T19732962EBE10693B6DCAD22EF9657753D7F6102131942E84E7FC9A2C15EB5CC622700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3ebb3ac5de430554937871cbabe60ce73657e1ca38584f7e159e75fc82fc9066
MD5 6b6dcbfe544569268465f510af702f8f
SHA1 3a383f6abe8b0ee90146ab0fbdd1dae851103502
SHA512 ed4c28d6b74bc204c5ade81d6cdf6457ca94056388fdc767a9e02df5b61ff5bdb25168e49942c61c55627e935f96b5743a8822352778d2cbc876181acd177c35
SSDEEP 192:5BRtNavLv7QvsPRpmWh9XxHsb+WNnvePpu2okkwO2VyIsnAUgE:5BRtNez8GXJfwGPY2NuOE
TLSH
T12C42A82EBD10697BADCAD22EF9557B53D7F6202121A02E84E7FC8A2C15EB5CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 196c896ac9184da43736389f234d368c2a8d6129b4c9919274e0cc80e9363b64
MD5 83d78c886550cf5b0d783488f628d0e8
SHA1 944304e48a5a31a850d4f44e97559f8d6492fc0e
SHA512 ca315fc53835e9131a166fed57a4e132eeb6efecf2b116da5053d7347a269d0cda26bfbd2214d585d8315e077dd4352fca5730b7e8cb6ae1dcd8b74eda145128
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934ZMTSl8h4otop54icD0B6KGyvn0Smhlm+9pyRNC39IS:Rt0ITo+TQ0IoiU2S4iPSmhlm+9pyuCjW
TLSH
T173C10875D05D5CBB08A6F486B0032957CDA9306BA955BE64FAE90E0C01E74DC5382533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 0b7cdd8393ae20bf18023bfd66ca04f5826e642b1c1a4ae6a91ada9c0aacf4ac
MD5 8154b5482de7efaa056511b1c785ea36
SHA1 35d39d684a25576e918310afaeccd33ade526803
SHA512 5c8cc50f90c2a14859be288be9d9c46f53aa10697ef5d5496bdfcc42cd5fe4e29db99af50ba67f0c90401789b3563fea1f760ca39e7e1fcf242f3d9bf7c40a3b
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok54mD0B6nGyvn0b4T8pybJv4a:xC0ITo+TQ0InDUDX4PPb4T8pybl
TLSH
T1FDA11935A0284CB74476E446F1626A43CFB9706BE9B2AFA0EAD90E0D15F70EC1341A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3f243767eaac640ee91870b146f1b6fce648e04c8aee40935d46c84759574176
MD5 27e59720166de216b8ad3b961ce7c432
SHA1 7aa739f645bf8a6882c3bd8b73b92c34f17007a1
SHA512 3412f9a206b25f255cf6684ea9f574d0344fec52a831cd56ad47050a3b46880e4cbdfb7b4d438556a18db932cea760e1ab8ba2b32349e14ce23d686ae93ed105
SSDEEP 96:RC0d+r2io+TJ/E0f6m934ZMTSl8h4otop54icD0B6KGyvn0SvQxwzQvhjm+9pa06:RC0ITo+TQ0IoiU2S4iPSIxjhjm+9paUk
TLSH
T11FC14A71A46D5C7745A7F442F0232A57CEB830ABDA51AF70EAD60F1D02EB4EC2382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8f72202a7c8a4fe49ef18add28989bbdbdb322c1f3d6375b4644fefcd73e6451
MD5 25c76e5570f00696400cd9cb5d701e53
SHA1 a7ce629b66b00e6d5129e81d699ade33d7a28480
SHA512 5e10e8988870ab13bc08ff57cb1ec3f881accef3431ab0fda00147b948a2bccd5f2ef47dc6c2de2a1b6d6f08d0aa22aae8a624b9f825ac9005f5bdebbffdc2a3
SSDEEP 96:RbJ0d+r2io+TJ/E0f6m934ZMTSl8h4otop54icD0B6KGyvn0SvQxwzQvhjm+9pan:Rt0ITo+TQ0IoiU2S4iPSIxjhjm+9paUk
TLSH
T148C13971A46D5C7745A7F442F0222A57CEB830ABDA51AF70EAD60F1D02EB5EC2382523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-201-0x0000026FE4390000-0x0000026FE4453000-memory.dmp

Download