hxxp://track[.]robly[.]com/e6415c57-8d88-473d-813b-452a744abe150DAB0F7E7B7F1AD482C6201A9D8B6679

Analysis

max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://track.robly.com/e6415c57-8d88-473d-813b-452a744abe150DAB0F7E7B7F1AD482C6201A9D8B6679
Sample260424-spvtmset8m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3932	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215175647905921"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3668	chrome.exe
3668	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe
Token: SeShutdownPrivilege	3384	chrome.exe
Token: SeCreatePagefilePrivilege	3384	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe
3384	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4476	3384	chrome.exe	86
PID 3384 wrote to memory of 748	3384	chrome.exe	87
PID 3384 wrote to memory of 3932	3384	chrome.exe	88
PID 3384 wrote to memory of 748	3384	chrome.exe	87
PID 3384 wrote to memory of 3192	3384	chrome.exe	89
PID 3384 wrote to memory of 3192	3384	chrome.exe	89
PID 3384 wrote to memory of 3888	3384	chrome.exe	91
PID 3384 wrote to memory of 3888	3384	chrome.exe	91
PID 3384 wrote to memory of 2992	3384	chrome.exe	92
PID 3384 wrote to memory of 2992	3384	chrome.exe	92
PID 3384 wrote to memory of 2384	3384	chrome.exe	93
PID 3384 wrote to memory of 2384	3384	chrome.exe	93
PID 3384 wrote to memory of 3840	3384	chrome.exe	94
PID 3384 wrote to memory of 3840	3384	chrome.exe	94
PID 3384 wrote to memory of 2876	3384	chrome.exe	95
PID 3384 wrote to memory of 2876	3384	chrome.exe	95
PID 3384 wrote to memory of 1364	3384	chrome.exe	96
PID 3384 wrote to memory of 1364	3384	chrome.exe	96
PID 3384 wrote to memory of 520	3384	chrome.exe	100
PID 3384 wrote to memory of 4952	3384	chrome.exe	105
PID 3384 wrote to memory of 2672	3384	chrome.exe	106
PID 3384 wrote to memory of 3040	3384	chrome.exe	107
PID 3384 wrote to memory of 3668	3384	chrome.exe	111
PID 3384 wrote to memory of 2424	3384	chrome.exe	112
PID 3384 wrote to memory of 2424	3384	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://track.robly.com/e6415c57-8d88-473d-813b-452a744abe150DAB0F7E7B7F1AD482C6201A9D8B6679
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd5fe8c728,0x7ffd5fe8c734,0x7ffd5fe8c740
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,16491352294175109893,4038849355603332115,262144 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1132,i,9392016375301882916,5755515364005890960,524288 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,6626547356739950157,10324756402338256435,524288 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,16543390210648557312,10204787450175299728,2097152 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,1364157711498390711,6142867933800304876,2097152 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,7421598854433898382,18269256033200633265,2097152 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,156622632430654841,9277263463943345836,2097152 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3636,i,9129749996111649714,6897351616625710320,2097152 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4716,i,10511339750279176233,4887027265055021156,2097152 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,12814680112798715557,5121821440814253872,524288 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,4565140041036627589,12971216407485317994,524288 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,15876265079459180276,2779887765195136975,524288 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5080,i,17296244943357689487,1349199108835641154,524288 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=728,i,7709267338474381784,19003191034972649,262144 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1000,i,4873659635235491071,7815758980165402959,524288 --field-trial-handle=1980,i,302443109321141584,4729004115276509031,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c5ddd7d1f263bf8d14c72492e7b3d2775e6b59caaf690f2877e29a9e79ed090f
MD5 5aa6f670f72b840b5c125d18d924bc98
SHA1 fd167b9591f8706f5798e82c25d8d81697d7ef4b
SHA512 3af456d930d4485aaf7527dc14c08b32e3b6d3897d7361b8a5f24929f7b2b5c81f87f08de903be35abe3c5149e016a6a1d1a1eec166b6ebb8bbcc1a94cb1ec7b
TLSH
T1AEE02B9AC965EC2F09FE071D21855345E75413AB2B81550F3B3C420C8FB463E618681C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 56cb76a99f0d6355fbe264f88650b1cc187c11849ebdef59047b0e85ccdb9c13
MD5 d1e52fdd6723f71fc5847d93bc4e71a5
SHA1 a4fdea77714b50c51e4300cd77caeec4c9ed09c9
SHA512 76f5044b72ffe8e88a8d7a689069d685bc483c380b4b19b7b727ff5675081fe88e00b361bdbec54a6987c54ee0031e680ef8b6296629297c0654dfea2fdd5c60
TLSH
T156E0C2723490F06CFF071A725C9C0C8A1B15A438CE754E5EB7C870780B32AB02547685
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 3d8658d8e048c58f0e7d3fa6d9321a0a31a4af1e528b1e18a4fb9ebdeba381aa
MD5 a53235c7b40657517babc1b7a5ae6aa4
SHA1 2c98db5ac029e0edeacd20533f6ae94d8e8e78da
SHA512 062c352356c418146b9bd490a6e53bbdbb73950ac7f11d2d1ad379249ac572de559668a064a37a8a0b986e512665e46d460aa5cdc94f30bffc2caa4be48296f8
SSDEEP 192:DuuTshOIaIaEg73DNcOTxjTlfT5Ogdl1Tp2EdPFr12TVud:DuuTshOIaIaEg73DNcOTxjTlfT5Ogdlj
TLSH
T109F1ADB3D3F48A2DC91195F5A7242E2FCE290534536C386789D4EF8B57F25B2E200A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 3dcc0848271f2df3f8e509d33cadb406cf562aea299d7f21773cb4a5fd51a356
MD5 b9dd028a1fe27c7e7b79e56eaea74523
SHA1 32224acfccff814d9c0b29172b0e713db7ba4b52
SHA512 80516927bfdbb433bb0956e13f8546cb1794ec7241a0797a98e10d5447bdce23d8b88535e889f1fa266171295aa0d06d8e6c516530ad58d0d60eedc834a8cd55
SSDEEP 192:DuuTshOMhaIaEg73DNcOTxjTlfT5Ogdl1Tp2EdPFr12TVu16jh6n:DuuTshOMhaIaEg73DNcOTxjTlfT5Ogdp
TLSH
T1E602ACB3D3F48A6DC91195F5A7242E2FCE290534436C386789D4EF8B57F25B2E200A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69beecca996c20efe5ec25a613ca0bc114125ea599546484accf8c4eaa73306c
MD5 0d402acb3a535514b91c91c498ba3f66
SHA1 73b0c6a52118ac59ef37291d6a112517831bf3e7
SHA512 c446bb76d64fcb80063adfa44c7375652d2c99dc2c2a4687078009e862959e008f8d055870e83ae3cddcfd8c26f96c2fc934d271a133251009a75ebacf61a9b5
SSDEEP 192:WRw5vLNUviau8Ov7rpAPRp2BR9+Hsb+WNnk6g1S2IZiEAyVyIsnAUge:WRw5vpiiKqfUX6Ewz/2Mi8e
TLSH
T16842B72DA918AA3BDCDBD22DF9117757D7F5202165902E88EAFCC62C14E76CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 701c29005b374cb9d6e54b083d063100587dbcb8cacc25582b4bb6ae8fbda4c2
MD5 983dd9316ac51006e2726aa70bfba288
SHA1 a0a0dc04323597c2c35c007360c12706488c68a8
SHA512 6aa03c7ebd61042b0dd53c95b16869bd701251f4a02f9a93ad3977860debf94a91f16e50c10b96340258d3b18a7ee02b7df9c01f7c586137b47fcb96cfc83265
SSDEEP 192:WRw5v+NUviau8Ov7rpbqPRpshBR9+Hsb+WNnk6g1S2BZiEAOVyIsnAUgE:WRw5vkiiKqfiXcEwz/2LiME
TLSH
T11552C82EA918AA3BDCDBD21DF9117B57D7F5202165D02E48EAFCCA2C14E76CD2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 341881bf77d544ab0592aba8c80d1e3ba5297725d2c3be3d0e508e64248cf8a7
MD5 931fc82e740842d9cc283b06ca5d2d6d
SHA1 104a3cfe87080f946322e2d451ec0e16b0ab7ac3
SHA512 1389ea6db478f84a9607d37c032c91e7ba56a818674510ee9e87a0b7e601c7b7db57aae2372ec078a5c8aee7c2ac97ec7f04cdfd394f3fcce70700d3e4edf7bb
TLSH
T178B012A0C0019701C01302F419D7049C7118EF118705130553E46E76D83F2904414150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe584b0e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe584b0e.TMP
Size 96B
SHA256 516a864488b5ab3a8e828da0e140048d421329c60b236b714a3686228e38ac27
MD5 dad5737b80acd8830ff116f3d22c3ea3
SHA1 c811fde0c24c43712ebdeb646b01a357eb8e0af9
SHA512 25f9a92c7c5ca3451938388a878d8fe931600896582e4f70840f1003f649a7b5a78e26e0732dd588ca8fbb90f639180ac17b7a1b310c0f2087caa2c7d1e5fa37
TLSH
T172B0222AC002E202CA0303B038CA80C83020CF30C223A20E83E0ABA2CC322B00220A20
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 c2106cef83feb686c10f86aec60b6c951ca7c04638aef19c1533766c69e5eb1c
MD5 454c408d3c330c16200b269024b01ae9
SHA1 047227b4e4a75342ae304065d8cd2131e4355256
SHA512 6b0c03b406c3a351b957d35f8cc38889ab5a118a1ea142d8a7e09fee8743850b5a4cbda77fed5b26c200d034c5ff845c1a1004209885bb04960afb6e1b30b351
SSDEEP 1536:LV/PDcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9I:5/PD3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T14D9302BA8E2B49F799BE5B92769A7809CD16230E706F688C7158534C21D41CC2F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 467479da507915090c5eb5c0016ea34c7ac0e666030273f12496fa4ae4058cf8
MD5 54f42950b87094dd5671bc0ea497e85b
SHA1 adc0335ba7189ca05e2041fd760fccde4dd8c111
SHA512 e059a8d66f78e2549d55472caaedd87bb940d0b7c1bd25bcdc09f2c7a2d03b748d545a8e9cc5bf1db143c35eb055bc3ee8cd7611dad1167326eed681dbcbb39b
SSDEEP 1536:jVMcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xM3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1899302BA5E174AE7957D4A8176AA7808CE12630D70AFA8CC315C639C21D01C92F73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 217f70a9a8ffbe4614bc9383f485fa9ecc6a24bd7b7ddb0724919f0a2fa5ea3b
MD5 ce703c09ba291d86a42779ac67f11a78
SHA1 3b57fc6a997bdaef8c77c037f0991f817f57078a
SHA512 e65aa657433743a1a45880e3afdc6de25861f431d648c4aef24b7fc2627a95d06ce1a4ef95c3ba324aab780902e762c9f8af96b344fbd5c0f9efef9b2a3e2ea6
SSDEEP 1536:IV3cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:a33Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1A59312BA9E1A45F799BE46D1729E780ACD12234E305F698C729C538C21D42C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 52b82be305d22be23138f45386d2fbebef42c3f725fa3ad359a8e1bedf6d5f0b
MD5 69be0b59378539b23d7ba1ecfab80708
SHA1 e411a1114b4d042bcf9020346f372324e9d1ec47
SHA512 09b9df04309ba89109117659eb277d2b34ed2a685797b30583af33edc7a4537ad45421c6210b27bac0940aa4bc6ee59b01706e3ce7bc5f607ca9edf2c073666a
SSDEEP 1536:DV3cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:R33Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1019312BA9E1A45F799BE46D1729E780ACD12234E305F698C7298538C21D42C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 e6dfbd7a1f667353efc579f75fe4916455bf0cf98517f3ea41cf3821ec4ad012
MD5 2cddc08c793276f5f900965c0b58ed49
SHA1 23c92f89785270f042ddaf9d8b31cd1d75df2e19
SHA512 c11512d83c392e9db9862d1497a22cd44406beeeda4b02451b6ec9b3d0b2d6a94bfe9d5021df47c94b607bc50561b1a7795cc511d82039d464ef5917636e56cf
SSDEEP 1536:DV/PDcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9I:R/PD3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1CC9312BA8E2A49F799BE5B92725A7809CD16230E706F688C7158534C21D41C82F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download