hxxps://ddx6dwxh[.]r[.]eu-north-1[.]awstrack[.]me/L0/https[:]/belairownerscircle[.]us19[.]list-manage[.]com/unsubscribe%3Fu=3669a928d7b909fd54737ffed&id=6e1e021c27&t=b&e=182360fe84&c=09cd991d08/1/0110019fc8e0a4a4-71d9ae42-8939-4f28-8cde-566014c43c88-000000/VD9fthv_EBuJdoGrBUlYxLXY8YU=258

Analysis

max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ddx6dwxh.r.eu-north-1.awstrack.me/L0/https:/belairownerscircle.us19.list-manage.com/unsubscribe%3Fu=3669a928d7b909fd54737ffed&id=6e1e021c27&t=b&e=182360fe84&c=09cd991d08/1/0110019fc8e0a4a4-71d9ae42-8939-4f28-8cde-566014c43c88-000000/VD9fthv_EBuJdoGrBUlYxLXY8YU=258
Sample260804-al88rasxcs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2684	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302763619843861"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4216	chrome.exe
4216	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe
Token: SeShutdownPrivilege	4916	chrome.exe
Token: SeCreatePagefilePrivilege	4916	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe
4916	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4416	4916	chrome.exe	86
PID 4916 wrote to memory of 4644	4916	chrome.exe	87
PID 4916 wrote to memory of 4644	4916	chrome.exe	87
PID 4916 wrote to memory of 2684	4916	chrome.exe	88
PID 4916 wrote to memory of 4408	4916	chrome.exe	89
PID 4916 wrote to memory of 4408	4916	chrome.exe	89
PID 4916 wrote to memory of 4940	4916	chrome.exe	90
PID 4916 wrote to memory of 4196	4916	chrome.exe	91
PID 4916 wrote to memory of 4940	4916	chrome.exe	90
PID 4916 wrote to memory of 4196	4916	chrome.exe	91
PID 4916 wrote to memory of 3216	4916	chrome.exe	93
PID 4916 wrote to memory of 3216	4916	chrome.exe	93
PID 4916 wrote to memory of 4752	4916	chrome.exe	94
PID 4916 wrote to memory of 4752	4916	chrome.exe	94
PID 4916 wrote to memory of 2536	4916	chrome.exe	95
PID 4916 wrote to memory of 2536	4916	chrome.exe	95
PID 4916 wrote to memory of 2868	4916	chrome.exe	96
PID 4916 wrote to memory of 2168	4916	chrome.exe	103
PID 4916 wrote to memory of 3012	4916	chrome.exe	104
PID 4916 wrote to memory of 3872	4916	chrome.exe	105
PID 4916 wrote to memory of 4216	4916	chrome.exe	113
PID 4916 wrote to memory of 2756	4916	chrome.exe	116
PID 4916 wrote to memory of 2756	4916	chrome.exe	116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddx6dwxh.r.eu-north-1.awstrack.me/L0/https:/belairownerscircle.us19.list-manage.com/unsubscribe%3Fu=3669a928d7b909fd54737ffed&id=6e1e021c27&t=b&e=182360fe84&c=09cd991d08/1/0110019fc8e0a4a4-71d9ae42-8939-4f28-8cde-566014c43c88-000000/VD9fthv_EBuJdoGrBUlYxLXY8YU=258
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff915ddc728,0x7ff915ddc734,0x7ff915ddc740
  2⤵
  PID:4416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,4893607760042237400,12427499459659243013,262144 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,15513556622954073432,7781853318696954386,524288 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,1967201264306313989,14183415598388272608,524288 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,15434915030100402962,18348025176025942892,2097152 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,11378804786181372513,17094406793030693366,2097152 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,12395944585400665572,677321787842954497,2097152 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,9107933960024286473,1318908592262425736,2097152 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4952,i,17074001245612024803,1562923657460977130,524288 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,8294095721450486920,192230742131473328,524288 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,6486224738700595172,14294297728029103948,524288 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5916,i,9470245482230692911,15407554504305136392,524288 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6004,i,16046923845985112107,3295167019220774904,524288 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=984,i,12088932805674524603,9225767743039343488,262144 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5904,i,1673910390800182858,3157898170438456872,524288 --field-trial-handle=2004,i,3797206367707768733,16079088423345086601,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 dbbd483f8eecc99f554c834458b650e1f88bc8b2bdb199742cbc27b7104ba00b
MD5 1b22b74e966b8923ba66e40099841736
SHA1 4d25ea6fc2739f3d33b7557176dd8bcd48a85d21
SHA512 75c1dac46693fccee1a9152f21f35768d51e356e8efa982debfea49922db081d432bd1f5a69bb9f8197e5f85518ab3b328c4578f4bf92dd06f62a0b3f1af0963
TLSH
T1E5E02BADC931FC270DFE475D50540646DA50135B17A0855F3A3C91188FB06B702859AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2f8345e9222952bc1927486de12e10ce4d13ae663946627f043e1e285f875b68
MD5 eeef1c0fe6fede4defed31cd568c8c6a
SHA1 fe1a56613618b13ac1b847b657fe98fde26aaee5
SHA512 c7c2a1de70b966b2389de3eb97ad642204d0a21f863ab32dda3c91d3529d3b3a70aeea895209d4e55a9b558e5db4f53fbeda2047cd37cb849f02477b270b90b6
TLSH
T16221A530DE927340D7D482B06CFE90EC783C1BEB98130DE3314552B03049305C157A8D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 999dcef5555d6d601c7b12742d32da4a7fb81eb859ffb3fb7b62dc1faace5f00
MD5 f48c3055a515b03e7e3f9aa583bf148e
SHA1 97651a15da5eb9dd52475daee6931873e1d6caf9
SHA512 b237b325db29827b0fc6150f3b49a671ff4af34b49e8f6069688b6bbb36aaa0dfd0f3599e8b6d2840778cfb1986f722081f95210b70f8dcb9f568741bc8dbae9
TLSH
T168717FF787F8896E890192F5F7156E1FCE2E0514432C7CA6C4E45E5B93E2472E14068F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4ee914c0495b9916e9888112d0b89c581a1aa9f19b53c8a7ffc8bcac656f46ef
MD5 9d4bed106124d2f0f392ddcf3d074048
SHA1 6da1703774ca1c64754c5a7e440b5210ee26f77f
SHA512 8c7ec67d7bae5e87eea58943b4739f756035a8f1f27e04a6ee0770fe3fcc35e7dda978fda7f662299eed8179ba8b9de3f7d216ac16f5c712f7744b1993e22ddf
TLSH
T15C518EF787F8896EC90192F5EB156E1FCE2E0514171C7CA6C8D4AE5793E2472D24068F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1208d9ecb3bcab63ac4c0bc0d5f63d5efc09ba790017d9217b2a8c21d4c43a7e
MD5 351fff4310eb6c441675c92e53ac9bca
SHA1 2425e2c728df225390ca41f5e1ddf834dcfb00a4
SHA512 356a5aa04efe202044491a115b06a61bda5e31cc2dbdff13936d68292d050b477495957c60c76e86fdda1afa879c8a40dbdce67542f893b1a0ac67a7e63c9c85
SSDEEP 192:IRtY7B8ssQFv7ApAPRp24L9qHsb+WNnGZ8m/2BZkxyVyIsnAUge:IRtYN1kUXFkwu52bFe
TLSH
T1D642C72EEA147A7B9CDBD225F9257B23E7F1103924902ED4E6FC992C15E75CC221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7e37d15f529f73e5a13c38e94a4bc7fbce3aa2a799627b30cc817d4dfc57ef34
MD5 19c64cce8f5ae1eb1a57515b4fe22978
SHA1 1c9a2622bf9f3edf15022a6753278865b1d17a99
SHA512 c497339bdde193412506a5cd3a5bdf6306135ad11dd2d9ba57c556bd4f71fc8bdd8171fbfee67a64e1a36442b110685ee4589a973ed128f23a8b18132ccdc7c7
SSDEEP 192:IRtYtB8ssQFv7ApTPRpH4L9qHsb+WNnGZ8m/2JZkxqVyIsnAUgE:IRtYn1k1XWkwu52TTE
TLSH
T13A52D82EEA146A7B9CDBD225F9157B23E7F1103924902E94E7FCDA2C16E75CC221B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fe7c77107ba44911969b888621c6ec9c6b308e5d24a3a3972e0aa25cbf6bcd12
MD5 634a4159321ca2d1a24045fead0b054d
SHA1 949d3bbaef93ad353f6e76abf0be7fd9b38994dd
SHA512 c5e97bfc158ca24a0eae4ddf7713174f3ee4d3e0f4972b2cc35e7fceda29b956e81b684655696acce918ab1b27ecd979c3033b7802ba848274d54eae6c55d2ea
TLSH
T174B0125080025201C04B03F511462898711CDF28D60E2705A3E0796698253608014090
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5899ba.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5899ba.TMP
Size 96B
SHA256 c86473b5c2ec21b668d701c236b29f458263d552a418379efeef0385eb1afd7e
MD5 b90de3a2035420964f1ef6767f0cee8f
SHA1 45802d97909e0c4bd027a2faf6ce739197660823
SHA512 ab470d1aaa2f6bf90c44cbd218c2377cf334b5288015a8dce77c2b5f0b01e0c491334af31834df7cf55634ef9dff8531941d9717d100fddc8371e901b2fcadc3
TLSH
T160B022A8C003B202C00B03F028C880C83030CF20C2A3020BA2E02A33EC2E322002C0E0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7fdadfcb74ed36e1e2e1ad78f5c54ca4cc41cafd8e267f4722a506c00697c336
MD5 b26d9a6de48113a858e356f5ee755b7d
SHA1 b470166a04705f27c56086aaeb6830a1748efd2b
SHA512 10df2af5659f953f737b6c95d2b2f539c966826f8af9fc2791a0feee05e07d1aa0c58b1f461e0a95d69bf2e9018c69e25bbdb9cabe41c9d4a85aa6084d78a159
SSDEEP 3072:5BGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:mm7Rkm1tYpBeh2BAog
TLSH
T14BC3023B5DB4E8375DB5B71EA08E0B1F1EF249A7C924DE92C8D45B0423E97CD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 01a3df175d931e5c23b510685b380306cf70483d6fc524fd0691d3a40b79fdef
MD5 9482119049d2d792682b73821b1cec1c
SHA1 6441165eb9db0bd03dddd53b1e74a3b971fb2f42
SHA512 bf8158024b306a55211b6a5545ff26fc7b81f1f3782466991c2cbd83ad50887f7b45508dc26fa5057407a589285b8600976a6b4d5242e1c618d9a317704db1df
SSDEEP 3072:gSZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:wm7Rkm1tYpBeh2BAog
TLSH
T1A6C3023B9D75E83758B9B71FA08E0B1F2DF249A7C920DE56C8D85A0423F97CC1A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 b3f82f0927000de5d32849df930711ec7152a73ac39c7c3d6eca6940791b421f
MD5 8a5035d6e4544d6ae4d63fb5dca37009
SHA1 a3dce12e6acc9c910a7dccfd98b650110bd7cd1e
SHA512 17a280cd2b139df523a2016dc97d4f42baa283b2c63b39e061446f5112f9e7eff98ba38167dd0c7fd154a224b2964a95cd043c3c08c9bbdb5cb1ea93551f66ba
SSDEEP 3072:AlGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:jm7Rkm1tYpBeh2BAog
TLSH
T1F9C3123B5D75EC3B5CB5A74EB08E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3db1981b01ca9380b860b286b76a2955d26e2aa73ea524bad00b775e27e83915
MD5 67ae22c1c51efda92a3c9c7dae36b6a9
SHA1 b9536a0f4191c3965468014b97d83f7a5578f5fe
SHA512 5bced78faf6e6a026b6d7bace070d2bbef063b8d9b968fd8c4bfe0007395d6bc037e88dfe383e68d6a4ca651fecfca39082657dc89f53f7b1f107a312955ef9a
SSDEEP 3072:0BGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Xm7Rkm1tYpBeh2BAog
TLSH
T1FFC3023B5DA4E8375DB5B71EB08E0B1F1EF249A7C924DE92C8D45B0423E97CD0A45A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 fb2efffbba7accd57d2ce70f52795a75a25f3ed64c6d7191b090be9df750d590
MD5 59be64c49bca53926d9829701816f811
SHA1 ec70356e07e525dd0f3b390a7762da513f78b2b2
SHA512 e1a8a26fa38c181d22d6aea5a86e44fd6b9d8c733124c7b28c57abd2f27f287439fb0f7c24cdff93de4da9104c927ac1302e2e5d67da53bd8f059e87aa3ef454
SSDEEP 3072:0SZGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Em7Rkm1tYpBeh2BAog
TLSH
T130C3023B9D75E83758B9B75FA04E0B1F2DF249A7C920DE56C8D85A0423F97CC1A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download