hxxps://electrops[.]shop/arub00193[.]php

Analysis

user interaction
yes
max time kernel
55s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://electrops.shop/arub00193.php
Sample260417-k3cafsat3p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3916	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208904383423632"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe
Token: SeShutdownPrivilege	4712	chrome.exe
Token: SeCreatePagefilePrivilege	4712	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4720	4712	chrome.exe	86
PID 4712 wrote to memory of 5484	4712	chrome.exe	87
PID 4712 wrote to memory of 5484	4712	chrome.exe	87
PID 4712 wrote to memory of 3916	4712	chrome.exe	88
PID 4712 wrote to memory of 4900	4712	chrome.exe	89
PID 4712 wrote to memory of 4900	4712	chrome.exe	89
PID 4712 wrote to memory of 5064	4712	chrome.exe	91
PID 4712 wrote to memory of 4932	4712	chrome.exe	92
PID 4712 wrote to memory of 5064	4712	chrome.exe	91
PID 4712 wrote to memory of 4932	4712	chrome.exe	92
PID 4712 wrote to memory of 2548	4712	chrome.exe	93
PID 4712 wrote to memory of 2548	4712	chrome.exe	93
PID 4712 wrote to memory of 3660	4712	chrome.exe	94
PID 4712 wrote to memory of 3660	4712	chrome.exe	94
PID 4712 wrote to memory of 2244	4712	chrome.exe	95
PID 4712 wrote to memory of 2244	4712	chrome.exe	95
PID 4712 wrote to memory of 4752	4712	chrome.exe	97
PID 4712 wrote to memory of 1424	4712	chrome.exe	99
PID 4712 wrote to memory of 1424	4712	chrome.exe	99
PID 4712 wrote to memory of 1944	4712	chrome.exe	104
PID 4712 wrote to memory of 1944	4712	chrome.exe	104
PID 4712 wrote to memory of 5916	4712	chrome.exe	116
PID 4712 wrote to memory of 1464	4712	chrome.exe	117
PID 4712 wrote to memory of 5996	4712	chrome.exe	118
PID 4712 wrote to memory of 3960	4712	chrome.exe	120
PID 4712 wrote to memory of 3960	4712	chrome.exe	120
PID 4712 wrote to memory of 2864	4712	chrome.exe	121
PID 4712 wrote to memory of 2864	4712	chrome.exe	121
PID 4712 wrote to memory of 2268	4712	chrome.exe	122
PID 4712 wrote to memory of 2268	4712	chrome.exe	122

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://electrops.shop/arub00193.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb16d0c728,0x7ffb16d0c734,0x7ffb16d0c740
  2⤵
  PID:4720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,11422304828182299422,4103382670462893353,262144 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,15605453779092008169,3109810247954065630,524288 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,8496460657187408692,1704718814935379955,524288 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,5864001528269028536,13994374185261888418,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,1254795458443953289,7008918758499107898,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,13868776385959803513,16074600308356508194,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3204 /prefetch:2
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,2190662287950249289,12668221617529601406,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3272,i,17713703187900868851,16476842662615740641,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,5421573204298110606,2392227250128294080,524288 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5668,i,2714744853515366340,10141314240907789175,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5812,i,12330729763904160591,2497046582156630278,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,10682687461775462831,1083323524129605612,524288 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,17406447458637852339,10298061716210816960,524288 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,5622354874128119571,13912697051879343139,524288 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3892,i,3863778752847622219,563603428640384526,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3480,i,11934287511873574507,11310789823437918298,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4744,i,15225293038710764819,16565449791427684285,2097152 --field-trial-handle=2004,i,10601960286476931669,11477521254373394443,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 294ddae326b4994dc00e07d68ff77cfb8e3b9bfa4e7b8d9802145d3902d9d9d7
MD5 d7ce2270645ae31e404b549e3529edaa
SHA1 60f9f4f9cc20c3e4b605b1777af4cb67231e2d68
SHA512 9c701bebacf1caf7d6e5d6002591b28488e8fbfb9c2d9da1f49f5a04fc79123d02178c0870fa2578608752970dfa6aaf5819f683e7d2a4f8b814b96c72388a50
TLSH
T187E022ABC863EC2B0DF92B196014470AEE14131B2B41594F7A3C864C8FF073B4682C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 81fba57aabb4d964f67e611b3d3bac480387f71013cf8e0c5d24bc2cd3af6291
MD5 98d19808ee6ccd00dba1e92a457d45d0
SHA1 bc9fbeeea5ad9b14973c39cf568c0256f23f2da5
SHA512 6ec866ac790d6438390fa794983386855aecf50cfe1159b3fb0b6b523d8c65f891cdbc316a5a6d26509264cec8af549f201d53b7e64f1eb2a18ee1f82731a815
SSDEEP 384:KRXVFoO9/TrPE5mqaUXGIwXaP6qFS0BZe:gdP99IwA9Fi
TLSH
T1C442E62EA904657F5CDBD229FE657B27DBF5102125802F84EAFC8A2C14EB6CC221741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 24891fef8420e734a30a6e002ac9b60e5c6e912d6681f731260d986882662ec4
MD5 2325d8cb40377a68857c351c6c313df9
SHA1 9d5464d8d0c6994d8aa7fbdc4111b635b2b61f2c
SHA512 68221eb55280ce6b0401e68c73a09eb26ce3f36c2b31840192ff907a0cee869049747b5c8ea4c5d130a52fe72e9a6d447c75bc1662cd05a19514c36295586648
SSDEEP 384:KRXVFoO9/TrPEzqaUXsIwXag2aqFSZBZE:gdPY3IwWdso
TLSH
T19F42D72EA914697F5CDBD229FE657B27DBF5102125801F84EAFC8A2C11EB6CC221741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 3c8ca6e9da5917cd1a342f01022ac2dad5fcf9f49c391f09183c2acac05586ea
MD5 557479114c5a083b2207104e55dfcf2f
SHA1 d3e710471a1cfec032652f2563a89b7c15908f1e
SHA512 7d54dd42fbe5915dc3df0e0e2892ea4168dc6bb38d6c21323c5ae596133c946d15bebf41e6d1b6cc8872570803b1eb10ff56c5e9d1d9304f53e40450b8d650dc
TLSH
T110B012708043A502C01B03F91186189835189F208B05130593F069B1982BB908414150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588c4d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588c4d.TMP
Size 96B
SHA256 6272fc16ef94615d4104996a88f61575aaa92b8e84031bbf6f4467b8b78e7f44
MD5 099eb3fe74e6272d4b24f5a3b5cdea9a
SHA1 219d86b0030a98c1b73ad47c762d1c24492021c8
SHA512 6a6f7012cb361c637ac8529c462f7a8322b500986a98ba7aec0fbcfb81c433bc9c195f990242577084bba75e3ac40b5ff43e1b4945f41a00e7aadfbabab7eaf1
TLSH
T183B02208C0033202C00203B02CB8A0CC3020CF22C30B3322B2F03A32CC2A220022A0A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ef2f256f29e402d3fd3fb15232cf0ca1d839e3183ecbb49282c29b009303eb05
MD5 177922adb673279ed8952867498463b1
SHA1 7238cef538b93aeb83a356b27b1db991bf53c9ab
SHA512 42fccfb91ecb32acb85fd75633c64cc80ad1add396210def9d564684beed77b4bd1d4defe96d2efd1e536466238bd2810ba29bda9bd872973637510022e9d6eb
SSDEEP 1536:0cC9cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0J3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T19E9302BA9E2646EB957E468176AE7808CE13130D709FA9CC319C639D21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 89ea9917cfdc8ecd25a60e6045d67a6b1b4966563b7a6b3cc18970bd5777b76c
MD5 197936b16eb38bad576657c92ea1667a
SHA1 0438fa01254b6176131c7581744fd1185f5d488e
SHA512 a52a265df4c6b5eb22a988794f612a18d850b075365f758829c4aa47363ebc5ab7ac4649d15845fed3b0ac8c3a78ffabc2ed21c22a46ea8b074a7f770ffac715
SSDEEP 1536:0TCUccYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0k3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T17A9312BA9E1A46E795BE0691729E7809CD23130D705FA9CC72AC538D21D41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 4cd623620e8365b840a055bbc4e7b7318899717f5d17605149036fc38505fa70
MD5 26429fecd1f004270e42e46e0ad855ab
SHA1 d23fb66b7820d8ebf12597cc41ab75e0a6162eb1
SHA512 095070564dbc636f1551ab2de956346001beade4710cba6a6351b56e5da8e2da8be877584f90d804d64dd4adb6dfa926317de939bcc7d44f145e79818d19742b
SSDEEP 1536:0aCUccYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0j3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1DB9312BA9E1A46F795BE0691729E7809CD23130D705FA9CC72AC538D21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download