hxxps://t136[.]notice[.]microsoft[.]com/r/?id=h2e2937c0,112bc9b7,1135da17&e=b2NpZD1BSURfZW1hX1RSWF9TRTcwNzY2X0ZZMjdfTUdfQWdlVmVyaWZpY2F0aW9uUmVxTm90aWNlX2VuX0FV&s=lJxfGearBuGQwt7CZ9L2NhAPKrUTviAVLV7WBCzpIEg

Analysis

user interaction
yes
max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t136.notice.microsoft.com/r/?id=h2e2937c0,112bc9b7,1135da17&e=b2NpZD1BSURfZW1hX1RSWF9TRTcwNzY2X0ZZMjdfTUdfQWdlVmVyaWZpY2F0aW9uUmVxTm90aWNlX2VuX0FV&s=lJxfGearBuGQwt7CZ9L2NhAPKrUTviAVLV7WBCzpIEg
Sample260809-pe9chaac96

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3028	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307513984766552"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1088	chrome.exe
1088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe
Token: SeShutdownPrivilege	1584	chrome.exe
Token: SeCreatePagefilePrivilege	1584	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe
1584	chrome.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3820	1584	chrome.exe	88
PID 1584 wrote to memory of 3028	1584	chrome.exe	89
PID 1584 wrote to memory of 4944	1584	chrome.exe	90
PID 1584 wrote to memory of 4944	1584	chrome.exe	90
PID 1584 wrote to memory of 4548	1584	chrome.exe	91
PID 1584 wrote to memory of 4548	1584	chrome.exe	91
PID 1584 wrote to memory of 1084	1584	chrome.exe	92
PID 1584 wrote to memory of 1084	1584	chrome.exe	92
PID 1584 wrote to memory of 2348	1584	chrome.exe	93
PID 1584 wrote to memory of 2348	1584	chrome.exe	93
PID 1584 wrote to memory of 4464	1584	chrome.exe	95
PID 1584 wrote to memory of 4464	1584	chrome.exe	95
PID 1584 wrote to memory of 1952	1584	chrome.exe	96
PID 1584 wrote to memory of 1952	1584	chrome.exe	96
PID 1584 wrote to memory of 4872	1584	chrome.exe	100
PID 1584 wrote to memory of 4760	1584	chrome.exe	101
PID 1584 wrote to memory of 3392	1584	chrome.exe	102
PID 1584 wrote to memory of 1408	1584	chrome.exe	103
PID 1584 wrote to memory of 1408	1584	chrome.exe	103
PID 1584 wrote to memory of 4216	1584	chrome.exe	104
PID 1584 wrote to memory of 1088	1584	chrome.exe	112
PID 1584 wrote to memory of 116	1584	chrome.exe	113
PID 1584 wrote to memory of 116	1584	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t136.notice.microsoft.com/r/?id=h2e2937c0,112bc9b7,1135da17&e=b2NpZD1BSURfZW1hX1RSWF9TRTcwNzY2X0ZZMjdfTUdfQWdlVmVyaWZpY2F0aW9uUmVxTm90aWNlX2VuX0FV&s=lJxfGearBuGQwt7CZ9L2NhAPKrUTviAVLV7WBCzpIEg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff0019c728,0x7fff0019c734,0x7fff0019c740
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1568,i,17712759422361972725,13238291400057470683,524288 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,11351289788575943730,2747448151763312790,262144 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,11605394823577973019,349885582111321304,524288 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,10813558357897897840,16960555785467855539,2097152 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,2531538079107757374,3758539759155927008,2097152 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4428,i,12746352371612074362,3261075508555225523,2097152 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4440 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4736,i,12632646942729916781,16047337084001533268,2097152 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,13758571364948997250,7520655560412658815,524288 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,14260224011193920144,3437087963560807326,524288 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,15887411939759645742,1171446035349323185,524288 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5184,i,15625439219361902770,5505392063669759125,2097152 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,17441355882604873339,5291360428545958518,524288 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5928,i,2593347919982963561,16916562856084981956,262144 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,9918146257072263098,1769147427832206655,524288 --field-trial-handle=2076,i,6202867898880640223,7166021626929792884,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1df734372999866c7146978889d10250faa2c9b1e6bf6b3527e53a6db450e53b
MD5 794eab52198f2e235d7727ba65c1118a
SHA1 04b8357430b645a3c2fae3f67d431155b67de621
SHA512 f1e5a9950afd818260c04057eb0642b02ebfeaa7f35b4908951f06c11edd23abe0af154a2083c2e38d670b7e2e10b5a7a9f659440659c7940c82f9940d41859f
TLSH
T17FE02BA9D821AC2708FD1B2820200746E784131A7F91C94F3A3D91188FF5A3A4566C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 0eea9582686e8e8eb2b0f3ce66d5ca725cc5fcdbb2a2ede9947c8e94c91b82be
MD5 88e0132f17746b112bc3492f25259b46
SHA1 bf799bc9a122eade6f1d2c00f521b772b90a200e
SHA512 e54c7e98174bd67093a86403e572c70a519e23300e243d3d8403a5caf06c9e2b062893c4635344a79e6708b58b145f7be40f212bdb3952fce734fc2e8d302e5e
TLSH
T15BD0220067CE88A3EF0003FC099F3C403A10067A8F00A342C2E2ACD9C8030E68F8F848
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c41864cf25203f7510c8de7b60896ce363c1c87dcfdbc6f9e5126d9751ffa48b
MD5 babf010c914d2cd02e2bd7c47bf6639d
SHA1 b79917355b11cc1aabafc40f4d27de1e0c25b2d7
SHA512 f34da6adc3fe1f1d77e64b3250e1067e58431bfe24236ab63af042e0a21f8f85639226a5c9bb4cb942d34d830253b2a709ab6e42287446ab2e7c9dc5636fe7a0
TLSH
T1FD519FF787B4857ECA1196F8AA14AE2FCE6D0510131C78A6C5D46E2B93F28B1D11174F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bf41f712b7c73d5e85c302c985e33344449f97931dea3f9a938aeb68dd231c3e
MD5 d7dde65036c5a3de84d053b0f97c29d9
SHA1 c70853d5039aa22e2cca902286d3f36220b7131e
SHA512 59586eb1732d4941d56da27e3593bfcd64ae45e96a6ee9745bc6bf7742b09d848dd512cc3b83dd845ba6edc883922478e13d218ead3f3cf43c1703a42e7a5165
TLSH
T106417CF783B4857E8A11D6F8AA14AF2FCE6D0920131C78A6C5D46D2B93F28B1D15078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ccc4c609a6fcb6ecda8c5a0259d41f4efc76d5dbef18b0cc1d04d5c7e027aa95
MD5 a4ca8b28a45e5751b2825c04ff6d3228
SHA1 57f512957129a2fa5712c1a1b24e972a47498224
SHA512 5a17439a3b70e6347a175c19c74c4789f712a98f4619484001416ad960993ca72036f3688de42d576f28450eb23cfbbc34991cef328bc01a1d01f4d06f7116df
SSDEEP 192:4RbE2taUE4RUv7cpAPRp2q0e9BHsb+WNn1GON072Ckgf2TUeAegzaMqnVyIsnAUp:4RbT4U/QwUXlDrwRe2Lgf2TBmaMqBe
TLSH
T19D42D62AAE60397B5DDBC229F9267B53E3F5102225902E94E7FC893C15E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1f7d2a07f1b7f06adc0a7c04acda3de37304aeb9817ce50267f91b7167db0fc1
MD5 6a2ee87e9d16cfd77ffa3f5fc4da3dcb
SHA1 6bacbd5a1c0637f6c0d31d236175462ecb8232a8
SHA512 47374f1e8a382e9f7d8e38b2d630bc5d083373aeea9ed94f5bb251f8bfda5b17f5d013c2b683e8362f8f02cb719b58ea1d44c5622b394a91da7dbb436e580db2
SSDEEP 192:4RbE2taUE4Rvv7cpAPRp2q0e9BHsb+WNn1GON072nkgf2TUeAegzaMVnVyIsnAUp:4RbT4U/nwUXlDrwRe2kgf2TBmaMVBe
TLSH
T11542E72AAE60397B5DDBD229F9267B53E3F5102225902E90E7FC893C15E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 78e100ce0fe703bb97922d2503693b11954349df0ac3262d4d78d392b30067f7
MD5 e76c37fba9e7263e1caf194182ba7b5e
SHA1 3f7a7a12374651e575b5704a2df940b8b8463485
SHA512 f1738cbb3a652d747c75e9395febf91db7779fd8df06069d42e019cff361d538fc858fbd406edac58d9530f30bd5ff249f395ba362c67449d026a155d4ddf5ff
TLSH
T1C8B012808001D111C04706F8158624887168EF219F0A1B0243E06976CC25251D025260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58be1b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58be1b.TMP
Size 96B
SHA256 6f2759f42773c7e624896e8795d3865efca1e49988dfd50eefca3ff4790a6fc7
MD5 b0bf4fbe5f1a5dab3c9ecef91ab80b08
SHA1 be912d84c6248725e49e254949d03889170917d2
SHA512 0a75bc39818ea3d3e67c7b8e5f8824e8562aafc3d5a5e6f4f1cc6dd3793fe2397080f95622ffd1a2355bf5cf399de251cb40e3c71a14be959f42aa320cc2b279
TLSH
T140B00257C512A312C34603B029A9E5E871E0DF29CA072216E2F41A76EC256A24526660
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 abe3478bd8543d9605f7159bfea185989be1722c296288daacaa894094d36ec7
MD5 c28ee83a36f9655c927ed1b839047058
SHA1 1016bfed38fe8741bb2b266e9f9b553933349e0e
SHA512 572df472ffc1290cc7edeb9528ca5f65460924312ee53ea8e2103ad9c3aaaa614f548748e16afcb15551a1f88e5893bf4a625ab09de3eff6f0f069bc3d8c0100
SSDEEP 3072:SDmFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:CmFmUi21rSm8uUVNSlzY/
TLSH
T17FC31210B9A3B8B3FE8931447AEF2A159DAC0D418291C5015673AD415DEF3CA6FABF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 ca5d2965158fd8314d74be7bfacf0adb189cec01fc95a40896621989b627c4b1
MD5 f1000dbfa663bbab04b5bf5d5274987b
SHA1 f7487b519c8db52b3ab385d83979036169db794c
SHA512 287d87123fb9c67eacda587b2cab29b9e8ea1ffb6672f19b3682f16aaeb487b222a730c630629269ba2f01c972d0cd1dc8fcee31182b37abad9cf50e3016c145
SSDEEP 3072:SQFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:NFmUi21rSm8uUVNSlzY/
TLSH
T102C31210B9E3F8F2EE9930447AEE2A159D680D818291C54157739D419DEF3C62FAAB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0998a7f9913a6a19245f476a10df4795c82566d7936ff3ff44c2393074e7603b
MD5 c66ff2cd39448658e17705b80ab52bd8
SHA1 721bd703ce680545f95ee0652a47438ce55296a0
SHA512 37ebc5e38c921a00d1521c74c3931b06c4eb8c98cd84110ed5f530ad456ca6c5c5e9db945840d33453072fb51698959630018648e8c1a37cc1c9b3641fbebd79
SSDEEP 3072:S/mFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:mmFmUi21rSm8uUVNSlzY/
TLSH
T168C31210B9A3B8B3EE8931447BEF2A149DAC0D418291C6015673AD415DEF3C66FABF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 c60c97917caa154c71c8074e3f179f6e72c5860b7ed9f3162ce750c830685285
MD5 3930ea452b3583e11b0f1524094a662c
SHA1 705dc95631832da77d595de7d46d50e2cb4ba4c0
SHA512 6bbd82dfcddf51b23b000a37d982b4ad1de06280db6f6ffb81961feb7ad77dca14d201cb12aa26fc856c1377650be7c8ee453fbd7f326481ca0f72ccb919019c
SSDEEP 3072:SZFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:0FmUi21rSm8uUVNSlzY/
TLSH
T187C3130076E3E8F2FE5930447BEE2A149D6C0D818291C6415273AD419DEF3C75FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b0be645b6a5f809fcec31751ffc7678a1f73b11561dc9745c7c4604f146fa4c9
MD5 ea9c4881ce0153a62122961debd9e246
SHA1 b3a791f3f5f6cef2a322a4ff6f498b46a7b1e835
SHA512 be7100df7a39ae642b6a91725189a8f77a4bc833d4fe1db993c4b47d37ba2e4ae79e6cf43f520942b2f5394ee7e9c3d49798714d096c436060433f9dcec5db5d
SSDEEP 3072:S/FUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:sFmUi21rSm8uUVNSlzY/
TLSH
T15AC31310B9E3F8F2FE9930447AEE2A159D680D818291C54157739D419DEF3C61FAAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download