hxxp://Cevalogistics[.]ltd

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 09:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Cevalogistics.ltd
Sample260810-k187eavfpc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3324	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308263753300997"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
596	chrome.exe
596	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe
Token: SeShutdownPrivilege	2316	chrome.exe
Token: SeCreatePagefilePrivilege	2316	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe
2316	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 3412	2316	chrome.exe	85
PID 2316 wrote to memory of 468	2316	chrome.exe	86
PID 2316 wrote to memory of 468	2316	chrome.exe	86
PID 2316 wrote to memory of 3324	2316	chrome.exe	87
PID 2316 wrote to memory of 1216	2316	chrome.exe	88
PID 2316 wrote to memory of 1216	2316	chrome.exe	88
PID 2316 wrote to memory of 2088	2316	chrome.exe	89
PID 2316 wrote to memory of 2772	2316	chrome.exe	90
PID 2316 wrote to memory of 2088	2316	chrome.exe	89
PID 2316 wrote to memory of 2772	2316	chrome.exe	90
PID 2316 wrote to memory of 3720	2316	chrome.exe	91
PID 2316 wrote to memory of 3720	2316	chrome.exe	91
PID 2316 wrote to memory of 4952	2316	chrome.exe	97
PID 2316 wrote to memory of 4968	2316	chrome.exe	103
PID 2316 wrote to memory of 4968	2316	chrome.exe	103
PID 2316 wrote to memory of 4880	2316	chrome.exe	104
PID 2316 wrote to memory of 4304	2316	chrome.exe	105
PID 2316 wrote to memory of 3372	2316	chrome.exe	106
PID 2316 wrote to memory of 4556	2316	chrome.exe	107
PID 2316 wrote to memory of 4556	2316	chrome.exe	107
PID 2316 wrote to memory of 2296	2316	chrome.exe	108
PID 2316 wrote to memory of 2296	2316	chrome.exe	108
PID 2316 wrote to memory of 1760	2316	chrome.exe	115
PID 2316 wrote to memory of 1760	2316	chrome.exe	115
PID 2316 wrote to memory of 448	2316	chrome.exe	122
PID 2316 wrote to memory of 448	2316	chrome.exe	122
PID 2316 wrote to memory of 596	2316	chrome.exe	127
PID 2316 wrote to memory of 4764	2316	chrome.exe	128
PID 2316 wrote to memory of 4764	2316	chrome.exe	128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Cevalogistics.ltd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8d4b1c728,0x7ff8d4b1c734,0x7ff8d4b1c740
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,6913561092466270,17890059294687135912,262144 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,3221366650537469838,13439574554187336181,524288 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,16671520259143856058,17620592330788362612,524288 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,5381392943359306699,2575196945513907115,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,3407078465304885804,3285485998480922578,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,3740205541750270435,16730050189351636646,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,12235010454578064868,2633256607117126995,524288 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5832,i,17791575457538848481,17169251612981224145,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3200,i,5689571689870862189,4024034227365808461,524288 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3180,i,1796036366117775153,9630734143487301555,524288 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,12318991830704739316,10212001812712930905,524288 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3180,i,14406162207485842427,15371086381704732767,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5864,i,17672650508194231993,2577041831820141113,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5708,i,9146297385023643943,13616865251936230146,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6104,i,3188777597355617450,9556174924894180366,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4468,i,11962354770750372684,5122068726570327489,262144 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3092,i,7270453428060256452,11118312099621027429,2097152 --field-trial-handle=2020,i,17569342657642722092,661755270504161223,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 e1e1b978a1a741d091044a6625d8f1da918bb8a0e4307c3235360b97c89f2df3
MD5 2edfa4175183270c1c966b52b76c6aef
SHA1 7ce78ffa733fe98de8704215aa74e9672dce6479
SHA512 16c774a8f44f0167b956852c432719a145fefd1356c72c457dc31d9dfa0ea53cae32ae8159c3bd55fbcf9ae1591680ad334c43c784ffce4746c631b867c878c2
TLSH
T162E02B65C861EC371CFD0B18A4145785D7A8139B3A41898B7B3CC10D8FB66364A85C2C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 80c0cbac1b42f8ff30eba019204adfdb5e90a2838edaec55ed65b3cb38d542ff
MD5 7b57778b1c9a69b60f3124c8fa6777dd
SHA1 84de55a979370c449a0612c58668e69c930bf370
SHA512 b9414a72af55d486bc98aebc403297a8506ee06ab5996c81570cbe9f65501bc691eae1325b9cdfcf2d81912107e7c5b040e2d66f9c77d6ed5a093d568f0c4743
TLSH
T12F419DF793B4997E8A1196F4EB156F1FCE690624131C7CA689D4AE1B43F2872D10078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1d3732cd3314325121634e906c4a523a9958bf38aa513068a836e19f74ab1007
MD5 4160d55a7b80977a4430d55021b1938e
SHA1 b5b2517db46abe038c813c1bf8dc8f7793105fdf
SHA512 5a55f52a7dbbab262710abee6a8d60c81a5ae3172d57b66b01962bb2a76a6ef6aaefd60a8acc7eb28e3c01c0298f7410e6d40ba29bdbe3a07083277073998e1f
SSDEEP 192:IRIDvMNCoE1v70pzPRpndsE9+Hccb+WNnHNPl72gFYMkwEaZ+VyIsnAUgE:IRIDvAYFghX/87tP52gFVkaZ2E
TLSH
T1B852B52EAE14693B6DCED629FD517B63D3F6102125912E84E7FC8A2C15E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0fe76cd35bcbc7dfaa8aedf427de037f08658cbdf463bac2f805102f58d2ce6b
MD5 d9c2cb8268a2a3a0a9741b0d1dad2f5c
SHA1 66a562b2f5c17c5491f3eb9fd68bcfc89e94232f
SHA512 caf5de3f82ef48c53f66ab615375a858b22600ed95b2b113a0aa0fad658b2a0628d42455c44dc261d242d63c8a6f723358f3f81fea5db7f3015fa0e219d8b17c
SSDEEP 192:IRIDvMNCoEcv70pAPRp2dsE9+Hccb+WNnHNPH72gFYMkwEad+VyIsnAUgE:IRIDvAYIgUX+87tPb2gFVkad2E
TLSH
T19F42C52EAE14693B6DCED629FD627B53D3F6102125D12E84E6FC8A2C15E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1cb2c21bfd19d831b664ef232919c16d617d3a42fd43022a4a6f01175a4c93d8
MD5 5483dc49a90957522a00944d81d926e9
SHA1 27219b2e1693a566ba6e1dfc1809669d6b99f847
SHA512 c2ab70e29154e66c9ac9e4fee1309483a34b60c9d12b0333e20936f61febdb8fbb4e932ad76fb7ce28fc2be94e90e58b42eec0dd9a5441db697480c8ed2390b0
SSDEEP 192:IRIDvMNCoEov70pAPRp2dj9+Hcwb+WNnHNPF72gFYMkwEaw+VyIsnAUge:IRIDvAY0gUX683tPZ2gFVkaw2e
TLSH
T12642B52EAE14693B6DCED629FD657B53D3FA102125D02E84E6FC8A2C15E75CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fb0f23515dab3ab9b1a9955b4783c0e56ced4b4846e3caae31f7ecbad5f5b3ac
MD5 2f6569e431c4e40f5c5b4fce7ff05e04
SHA1 73994469f10fdef32a00d0e0b961b412897b831b
SHA512 4153be5caad7cf337efd1da2acd3ad9b99f0e8a428a46756e5b65daea295b0bddb881f94aa5af70ae42e85c0afcb511be6ef838af31b349b15bb36cd1b53c941
SSDEEP 192:IRIDvMNCoEPv70pzPRpndsE9+Hcwb+WNnHNPl72gFYMkwEaZ+VyIsnAUgE:IRIDvAYHghX/8PtP52gFVkaZ2E
TLSH
T11252C62EAA10693B6DCED629FD517B63D3F6102125D12E84E7FC8A2C15E76CC322701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9a63a02af86b793bc7723ea8579017000fbde21723150ca89cdaa0102d54150d
MD5 3db4d2ed90c53237037f403d9b6c10cf
SHA1 91febd0c861f52fac9b9c081f7e738838423da4a
SHA512 20a5acab3273b075187518ff1d84bdfb24fb19e0881b09c9805647d3b805dc5e2037a9ee22124705cac465e1ac8b91972117ed00cd2d49a563818ec658fd5de0
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcSjIpXODyJ+ErU3MrHGRxVJZU:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97p9
TLSH
T183720A676C488E7B0F98CACCD8267B4FADF5024B65E9886453FA582903D5BCF11091FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 10d7507fc8b861a6dc5cd19dfd41cefa756133cb8023b51246dbda4e41ac3d84
MD5 0295cc338744a8992f35943495f66670
SHA1 3cb8a4a89cd089fd758898d2e19c982d2294a239
SHA512 25223e72b42d5c9f2d50d04c35077d3a9542d2859ddc2a48c7b79f1e0450b594c4458b955ab8889e947b9bcab28cf4839cd190e6379a81932ef1b59ab330e371
TLSH
T197B0120080025151D04286B41542559872545F1E960A170553F4FE32C82D1A18424050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f586.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f586.TMP
Size 96B
SHA256 49c50405360213398d4bfe66a91219e331c89bef41abbd00ca9dbc0c158e5b92
MD5 fb4a4f0cfe9195aad2567f964e1d8768
SHA1 ec47f918d339253c8206159d067d7e73957bfdb3
SHA512 be2f3cd97f8d07ae3be5eb79080dc535f98a39bcd449231c9f815a38ecc9e16c932644789540886ab429608714ec96193d96e15090346928c396b7e56e6b5bd0
TLSH
T16DB00255E6526B52C84203B025A595D87560DF27C6035326F2E03B67ED257714569170
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 41f7523e25a5d68c8b9097d062fe7152b3f0f9a2bbad9bc8e19c559f5d613598
MD5 b3b9b43301c2a9701def4dad3ff9e8d4
SHA1 e5b1721031f799b54c88253b3dc739cd5e898087
SHA512 77f69a8188d2e5c4ce528c325c32d75ba3cdfc286f8c87f8750d91904f187a978590e49c1ba8576a7ce2db7be3464f16447ea75bf104798a62e76d431e2093ae
SSDEEP 1536:90zyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:K9qfd7NtZL8cHQRZEQ6Sps3
TLSH
T173C30237ABC21F339DD7DF60B5130F9A93F644AA9034D301EE6D3BAB6883591A44249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5b08767357930515abf923fe13fe1f32104744b4760a66435c50c5ba8d6b4d1c
MD5 d989b35eaa6bb0c816c69f2b58ebdeba
SHA1 c85b2a2773eff95ad669dce837423ded18d15b6d
SHA512 1d7b576d630bf20cabe71d5395e8c080c4df36a3c3153543bb7f15866b8132e75d9b1292c61d739b684edc3106c040e33e62916bf4fd20c871a8446a5ebc2fa0
SSDEEP 1536:9hZ5yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:XZXqfd7NtZL8cHQRZEQ6Sps3
TLSH
T193C30237ABC21F339E87CB64B5130FD797F644A99034D301ABAD3BBB688359165424AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 4d9ad2999c06c9e88623aba590968b2944b4c770082c869500ef3aa3e0739c8f
MD5 c1cb3035dde9239bb5a4037723a8ecbc
SHA1 a480c94a966b11c4b5a54533a0870de0b07d0065
SHA512 a1ef2b945ff5fca5506c6c5a817923683532a7b49bc0c9b745f4c9c817931ddf89d35d9c9d413ee049e66181723187bc0d88b454fdd5c032a65468fdd37cfef3
SSDEEP 1536:ehZ5yD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICb0:yZXqfd7NtZL8cHQRZEQ6Sps3
TLSH
T111C30237ABC21F339E87CB64B5130FD797F644A99034D301ABAD3BBB6883591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0d213ed5127d0bb5397d5ba4acdc07e321ac74234092702bfe85a5696eb09ab2
MD5 f2b079718e85051369f532a1bbc3f2db
SHA1 6be663fb08163e4444b365123cc8245b03d7fbba
SHA512 bf430c5efa1d546b675be4c02ac3cc543f3ff76d67b72131ef2e3e8db53e21a8381093e7721685e32b48deeadf5a7b9e27e5a543635d957fe098bdd003e2be3e
SSDEEP 1536:bcLyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:4qfd7NtZL8cHQRZEQ6Sps3
TLSH
T117C30237ABC21F339D96CF64B9130FDA97B644A99030D301AAAD37AB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download