hxxp://homesdepot[.]ca

Analysis

user interaction
yes
max time kernel
85s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://homesdepot.ca
Sample260803-xtbc1swfqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1836	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302577066423917"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe
Token: SeShutdownPrivilege	2220	chrome.exe
Token: SeCreatePagefilePrivilege	2220	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe
2220	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4952	2220	chrome.exe	86
PID 2220 wrote to memory of 1836	2220	chrome.exe	87
PID 2220 wrote to memory of 3328	2220	chrome.exe	88
PID 2220 wrote to memory of 3328	2220	chrome.exe	88
PID 2220 wrote to memory of 1028	2220	chrome.exe	89
PID 2220 wrote to memory of 1028	2220	chrome.exe	89
PID 2220 wrote to memory of 4368	2220	chrome.exe	90
PID 2220 wrote to memory of 4368	2220	chrome.exe	90
PID 2220 wrote to memory of 3388	2220	chrome.exe	91
PID 2220 wrote to memory of 3388	2220	chrome.exe	91
PID 2220 wrote to memory of 3296	2220	chrome.exe	93
PID 2220 wrote to memory of 3296	2220	chrome.exe	93
PID 2220 wrote to memory of 3764	2220	chrome.exe	94
PID 2220 wrote to memory of 3764	2220	chrome.exe	94
PID 2220 wrote to memory of 3672	2220	chrome.exe	95
PID 2220 wrote to memory of 3672	2220	chrome.exe	95
PID 2220 wrote to memory of 5032	2220	chrome.exe	96
PID 2220 wrote to memory of 5032	2220	chrome.exe	96
PID 2220 wrote to memory of 1476	2220	chrome.exe	97
PID 2220 wrote to memory of 1476	2220	chrome.exe	97
PID 2220 wrote to memory of 2244	2220	chrome.exe	98
PID 2220 wrote to memory of 1884	2220	chrome.exe	114
PID 2220 wrote to memory of 3368	2220	chrome.exe	115
PID 2220 wrote to memory of 1784	2220	chrome.exe	116
PID 2220 wrote to memory of 4112	2220	chrome.exe	117
PID 2220 wrote to memory of 4112	2220	chrome.exe	117
PID 2220 wrote to memory of 1796	2220	chrome.exe	118
PID 2220 wrote to memory of 1796	2220	chrome.exe	118
PID 2220 wrote to memory of 4796	2220	chrome.exe	119
PID 2220 wrote to memory of 4796	2220	chrome.exe	119

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://homesdepot.ca
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff4ed8c728,0x7fff4ed8c734,0x7fff4ed8c740
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,18109938073623692242,10938454906047831395,524288 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,14836657552781473301,9240672748121321487,262144 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,13031340897088711812,3599476053945605275,524288 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,12303931505841696096,8548030143968765048,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,807660472041319592,13979308805157778915,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,6672152922956764266,16175084380015443026,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,6572709209514636481,17949861522892075844,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4284,i,5010734570611070673,890461342813972649,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4716,i,7540221298874855285,18295309919603209291,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3024 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4900,i,7597216672980886232,16235717595009190815,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,9624049746206329150,1394944440517664415,524288 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,15278076478118313205,8757186491085419497,524288 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,10407054908381542730,1021704149534094767,524288 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,17727547309112482080,2642936797386859476,524288 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5852,i,1050654188285073574,18394901077870052062,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4920,i,8193677911358291052,2904784649021522681,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5800,i,1995890937132586625,14594119429962835823,2097152 --field-trial-handle=2020,i,10023387495143378243,15947214048086770738,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 44810753c0a788abd1d4c8ad73beefa51faa74d11a327f74bdd3584c24622150
MD5 386841ba3a4313cda15fb99e852c416b
SHA1 f90be225846da00fb1cb41d0b7c82c4ec25e3e14
SHA512 c1e4e07425aab4f3742f0659b8644ae2775312e9d7382e563377d132aa33f2f8235d9fc757fc7b55bc0e188ba3a069af2f0c2b22805d5267d152f522019e2a8c
TLSH
T1AAE02BA9CC21FC2B1CFD4B1D5094074ADA10135727A0895F373D921C8FB06AB1585D5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f44f3308e8e8f5ede4803558fe920ad71792a82f7f15567e4922c8c1331086eb
MD5 dbd93d58ec5982e1fda30764ac25b3f9
SHA1 483f8769aaa0066f0c669d96ea07bc67eb2fea02
SHA512 b7457c563a885dd2f249c9a51541139720559b2c5271610ed895b990f782a881449f21216d9d48f333ed7acb4c16b6fb813082f7c09a332d0078c0a40955f7f5
TLSH
T112418AF787B4997E8A1196F4EB14AE1FCE6D0525031C38B688D4AE1B83F2872D10179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c7198d6da85b4c8f352ec43e3e17e981c8631f1d3d7de08f5d53abc0485f383c
MD5 d6a796026aef1f606881e83e1fa71b01
SHA1 8c20ef0744f3c0aa232aebd68defe737d634b3ec
SHA512 442bb5de750a42bf89ab86039e9d0d5fb57aa60fb4085a25e4552006e230c583f4b4c5bab7702751fa4881444b8d05d4ee4df471f4816dd7740090b072d00f11
SSDEEP 192:IRZwcH72W8wT8KDAv7ApAPRp23A9qHsb+WNnl+g9+92Aj3kwDMVyIsnAUge:IRZwcHd8wrckUX3kwgge2m3Ue
TLSH
T1F642E82EEE14693B9CCBD229F9257B67E7F5103921802EC4E6FC892C24D75CC621781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c297661686699d79fa944dc9f20a054a3005ec503776e196f1172d2cd59efb28
MD5 3e4a975cc06a07cfc49503fa77fc0ec2
SHA1 7dbd355b2cac01c509b5992538135a289ccb1b41
SHA512 730d583610fc32615dd92619dab7086114277ef745348a64c63ef0f72bdd44fc153669131dd3b1db47f5dd0cc30b12c6b06dba6c5283a2e215a1de6809d86aba
SSDEEP 192:IRZwcH72W8wT8KDkv7ApAPRp2369qHsb+WNnl+g9sjEej3kwDOVyIsnAUgE:IRZwcHd8wrAkUXhkwggyEY3iE
TLSH
T14542E82EEE10693F9CCBD219F9157B67E7F5103520802E84E6FC8A2C25E75CC621741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b29d148afde942a0468f535a946dd5a239ab1488d47c94cf2a03962e568d7dd5
MD5 8279459e7103344a0740c256b380fe32
SHA1 5eb1a0449238fa39bf0ae82e24e101a154134f5a
SHA512 39294584c46278f01780d0a7348bd02ef91411705b2f25866d5829a46a418287b36e87332abaf6d8a86d69da1db9af65aca45534c6b0625034f8823ad807a9b5
SSDEEP 192:IRZwcH72W8wT8KDJv7ApkPRpa369qHsb+WNnl+g9sjEPj3kwDgVyIsnAUgE:IRZwcHd8wrJksX1kwggyE73AE
TLSH
T18C52F82EEE10293B9CCBD229F9157B67E7F5103520902EC4E6FC8A2C24E75CC621742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a9b2eacfb7c204645c5f86a71fef2e0e3b0e0772a55c0ae62ec1d669f6f23659
MD5 d8e9f98de9e164d5b69c1a365e26170e
SHA1 093be6156a6cffa9e31954bf37d4e23e8c7be219
SHA512 12f156a2cde85d575c4f7f232ccb6371e674e9883ef80e52a1da56e3897341508087cc1aaedc7716b67a1de1a147dbb9e8e0753f1401a40038466e0835e42a9e
TLSH
T1E4B0126088816101C04302B021C624D871145F11960B170283E07D66C8396628018071
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59137e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59137e.TMP
Size 96B
SHA256 3663de5dcc10c656c9eb4229f18d4537a95efbfb74af7937ee07a923cf842e96
MD5 42c15c706a48f157a2b4e0fba4338135
SHA1 d6e37222550d15b117727077ab687631397eae5e
SHA512 a025127b27485039c5bab624a27e657fb9af4f4e4f02591402bb64de181e3f749a7b98dd31963c9aa1b10e475b11f59e2a19fb3cd5f96979df44d5cd51013d64
TLSH
T12AB02208C2023202C08203F022AC8ACA3028CF3AC203032283E22A22CC222308038220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 bd8593f433220173c5e7ab86bca32f353dda3dd2671107b59626ab3b98a518e0
MD5 0bfda263647214916a2fd30f0a9c32e8
SHA1 16cf7539fc479984d04e2e7adbe26d3f9e36cbf3
SHA512 9dbd69d5e3d5685b14651567332bc1522b063e18f30a2e050c74943d84d2d1743077f06b17dcf057a9fbe40eb384cfa0853b23a913e727d45ce3b9674dd82fa7
SSDEEP 3072:X45Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:I4m7Rkm1tYpBeh2BAog
TLSH
T101C3023B5DA4E83759B5B71EB08E0B1F1EF149A7C924DE92C8D45B0423E97CD0A45E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fabe032270ade752e39557ac12871dbff792bb618c09af232f12d20e8811c303
MD5 5148301e29a2f17baffc7143fcb84a12
SHA1 bc79c159bff0a4ffdc687cbea25a32a16939fc44
SHA512 d4dd8b0eac40092a1c480bcf3cc2cad9a1e2db0256e0eafbd3786d61e09c697dd92083980819fea99aa3b55af8892ec7010a90c0b3744b4d187b7f4e779ea695
SSDEEP 3072:E45Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:L4m7Rkm1tYpBeh2BAog
TLSH
T10FC3023B5DA4E83759B5A71EB08E0B1F1EF249A7C924DE92C8D45B0423E97CD0A45E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d1d50e13cb9287bc7f0d0842c3c6079cdf2ffcc020d9ff69d5a19d04a8909319
MD5 c4c678dc31f8aace12e7b2b529463561
SHA1 c1d35ca8ec0bfb228a63af99015b1b11e2624150
SHA512 b404e1516001792c2fda0e2556d556778b915839ff482a946346254a11a079070e4eaeed0739a4530bd311dd6f381a84008c86c6da5847aa82f3b21fda7c9c2f
SSDEEP 3072:AeGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:im7Rkm1tYpBeh2BAog
TLSH
T1CBC3022B5D75EC3B5CB5A74EB48E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fcf58a013b6c75579cf5605574186ac55ba2ca3646526ea794a96acd6047908b
MD5 a61a85b287b941a2c9c63597ec7e9767
SHA1 0ec18270f9212c3523463072172c4792edfd8dc7
SHA512 92dc68ed748edcedde7d80e63c26b80f78cbdc51826481cbdead30ae6a7e44e4ed4380e14766459885a6e06196adeb4cc2d6fc9d788d991f2918e7f7fda33961
SSDEEP 3072:X45Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:I4m7Rkm1tYpBeh2BAog
TLSH
T107C3023B5D75A83759B5B74AB08E0B2F2EF249A6C920DE52C8D85A0433F97CD1A44E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download