hxxps://haeaproc[.]com

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://haeaproc.com
Sample260820-v754fasdkd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4104	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317211597740748"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe
Token: SeShutdownPrivilege	812	chrome.exe
Token: SeCreatePagefilePrivilege	812	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe
812	chrome.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 6104	812	chrome.exe	88
PID 812 wrote to memory of 4104	812	chrome.exe	91
PID 812 wrote to memory of 5440	812	chrome.exe	90
PID 812 wrote to memory of 5440	812	chrome.exe	90
PID 812 wrote to memory of 5132	812	chrome.exe	92
PID 812 wrote to memory of 5132	812	chrome.exe	92
PID 812 wrote to memory of 3652	812	chrome.exe	94
PID 812 wrote to memory of 3652	812	chrome.exe	94
PID 812 wrote to memory of 4480	812	chrome.exe	95
PID 812 wrote to memory of 4480	812	chrome.exe	95
PID 812 wrote to memory of 1056	812	chrome.exe	96
PID 812 wrote to memory of 3300	812	chrome.exe	97
PID 812 wrote to memory of 3300	812	chrome.exe	97
PID 812 wrote to memory of 5468	812	chrome.exe	98
PID 812 wrote to memory of 5468	812	chrome.exe	98
PID 812 wrote to memory of 2412	812	chrome.exe	102
PID 812 wrote to memory of 2412	812	chrome.exe	102
PID 812 wrote to memory of 2088	812	chrome.exe	103
PID 812 wrote to memory of 2088	812	chrome.exe	103
PID 812 wrote to memory of 1700	812	chrome.exe	104
PID 812 wrote to memory of 1700	812	chrome.exe	104
PID 812 wrote to memory of 1072	812	chrome.exe	105
PID 812 wrote to memory of 1072	812	chrome.exe	105
PID 812 wrote to memory of 3352	812	chrome.exe	106
PID 812 wrote to memory of 3352	812	chrome.exe	106
PID 812 wrote to memory of 4440	812	chrome.exe	107
PID 812 wrote to memory of 4440	812	chrome.exe	107
PID 812 wrote to memory of 2028	812	chrome.exe	109
PID 812 wrote to memory of 1204	812	chrome.exe	110
PID 812 wrote to memory of 3232	812	chrome.exe	111
PID 812 wrote to memory of 1032	812	chrome.exe	112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://haeaproc.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd217fc728,0x7ffd217fc734,0x7ffd217fc740
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,8632738733614077684,17963738819097480630,262144 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,16062931881310167254,17154184374165632495,524288 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,2896245178258588289,1969460715190155179,524288 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:13
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,1962650634665924666,12234863400537711186,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,12838947476920287765,9023588068969675796,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,7831369790228169581,7064545328302693434,524288 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5552,i,12977436840696713823,15417292314706351116,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5592,i,16481201613224946761,8771982486315108880,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5912,i,17469401949830346714,10656633575003219397,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5584,i,6736638265265362132,2933159879351861156,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5712,i,14848894146592589060,13060532458923086162,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5736,i,11437410429107579017,4026491490530019722,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5592,i,2578666743428412141,17936736319672027436,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5960,i,9150239894238745901,2504863487074120224,2097152 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,16580946357252456255,14281365502114350566,524288 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  PID:2028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4688,i,9587319100197824808,6713741882199805182,524288 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,5250960027877400009,10589490087320419358,524288 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5632,i,16987243361445249749,4374071423625464555,262144 --field-trial-handle=1904,i,4105906021855463060,1848522243096059156,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

086294de-ae9f-41fe-94dd-f781f16810db.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\086294de-ae9f-41fe-94dd-f781f16810db.tmp
Size 5KB
SHA256 ce9ed6f8746328f16c9e94f08801043bf17cadbb3e4ee95a5ecb1d6c4a2547a2
MD5 f60e786da5d8f4831e2b4c45c0db2435
SHA1 90549eb6d475b1036bbef0c3aa478ad2515d1fc5
SHA512 b8c3d0d34a74922a33c80698f8fc87bbe345dda3d6251548b9d00e64129e2edc2776a9138d918b97b69e0f305291c04317344bcc1c032ec66e8636db2c696c72
SSDEEP 96:6bJ0d+PTkblaRZiIEby3rUfsfuZ8IG6GGwbSl8h4otop5WFIDMB67Gwv4Y+mE1IW:6t0cTkJaRZi/CF2lSiU2K+Anq+mEmWG+
TLSH
T181C13B31646DA87359B2E995B0033947CFB9326F7851AE54DEDE0F0901FB1AC1353027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d7afc35-8a48-40a5-b291-b58809b868b4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2d7afc35-8a48-40a5-b291-b58809b868b4.tmp
Size 11KB
SHA256 70da9acb55adee71dee3b7e7d58d57071665b14510ab4a428f36edc44a86cef9
MD5 d806f0a2565cfb8b9d3037d6deccdae5
SHA1 e12a24afa6b2a51a9aa2ed30e00a1d08bf3fce59
SHA512 497385725638ca0794c7884ddb418060e8cbfdeffb5ae18e23731126148666c620d4e69fab9bfec05ed62195221a126853b6d7cded6806e47c21301795103843
SSDEEP 192:+R41Yrav7ivAPRp2r/9rHsb+WNnV2I1E2EQZkwMagjVyIsnAUgR:+R4102m6Xy5wg72psagFR
TLSH
T12532B62EA925397B5DDBD22AF9317793E3F6102121D46E84EBFC892C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 30b134b9ce6ba25c47adc867827acbfb3071fdf4e62fd6ecebf0c47efd015e9b
MD5 7b50a2fa779eca3de8ab90f0e55e956c
SHA1 2983d01a5e32bb34b2f19210f7ede296016f6213
SHA512 09f2c3779048fe6a4588aea66b00910ec93a789a24e7908d55cb002209f632ec5b4425ce687c5e5d2ff647d4572e0b595bec2e7bbcd3ded0386c69aa474c0a7d
TLSH
T1AB31B7DA15CD9024FF31BF7489EB4D0A703C90AD01932F03C09158F48A673F17A2A627
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 22383dfdc8659cbd63f041457b62e31e8e1490743c3c5b7422618223ba3b7d6f
MD5 ccdc177ca0dfbaf2914e4a6765fb567b
SHA1 eac54b09b0167ca6161a4eb485c9a908fcbfbef9
SHA512 1b47d04bb78b47e2eb7fdaf145f134f0e050a55dc299a72bb301ec309d35cabc8ab47a3ea4b735f9deda3a5859a06d76b0a2aabcd522ed78842748c1ce58484a
TLSH
T186318CF783E4852D995192F4EB156E2FCE2A1514431C38AAC8E4AF2B93E2471E10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2cee1f95f78e84d29a900f5fa88c55b1f993aff054f77ad828dcf389d6e3b2e3
MD5 2e28c81f10a0d4e58ca70e1f7fc6f9bc
SHA1 0c453877b4f519af79765fca3f80d85ebaa95853
SHA512 515ef07753a83a4fb944a1396699da4e01f7a6768d4eecef95542d90e02ae9bba32302d1a121c3a045fa1ac32a579da6250d2a6ecfcba39eece6692fb6a51eb1
SSDEEP 192:+RN1YrKv7iv+PRpIks4T19rHsb+WNnV2IdNYkQZkwMa7jVyIsnAUgE:+RN10GmoXC4Z5wgyYJsa7FE
TLSH
T18842D82EB92539775DDAD229F9257753E7FA102121D06E84EBFC8D2C14E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5b1b8477804f95773f0ef43040115d00b16772f36a0d9e6780b72d1a19aeb020
MD5 b1d2a6ba5c7d4536e94149a673096a8f
SHA1 b4d6bc3a9b63dbf8ed18830eeb0b90354506cd66
SHA512 1f8d359d9a8ec45852e4aa6a3153fd8523dd9ce4124cef275f5f12b67da2d3fbec65f97eccc83d0feb23d5ba90c74608ae92ace221016dbf72f296674a05400a
SSDEEP 192:+RN1YrRv7ivAPRp2ks4Tn9rHsb+WNnV2IMqeuQZkwMagjVyIsnAUge:+RN10Bm6Xg475wgie7sagFe
TLSH
T13242E82EB925797B5DDBD22AF9217793E3FA102121D42E84EBFC892C14D75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f0373c880d155f74255a9885d6e1923c5aedbc000a6669f8b3a22d8a8829b967
MD5 444a7f9fc82d0a78693efea358b47d55
SHA1 ae5ea3194ccb8edce3dca889eebc72accc762fcc
SHA512 37728cb0400b6c2b927fba7ab41a248b969df3d042fea1f43bb62b3e1a4da3acd4e32f12baed0271486330a3952203475dc3750782f4f30fbb34aebf700d7990
SSDEEP 192:+RN1Yrpv7ivAPRp2ks4T19rHsb+WNnV2IdNYyQZkwMaPjVyIsnAUgE:+RN10pm6Xg4Z5wgyYnsaPFE
TLSH
T11442C72EB925397B9DDAD22AF9257753E7F6102121D46E84EBFCC92C10E75CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 377214f648d46362e6b3ba61a4a35f0b3ece9941968bbbba3d2ad7ec28b97d19
MD5 7474e77ec98ad67b1de76a2bcb904b87
SHA1 1fd8aba26460037ff3c385d81628b3b905985258
SHA512 67e346a0f8465ab666ae21bc92d69708d4d803b8aee3da848c9b2e2d8e52bc6b8a6f9afb8c8f23fb839086bb7a9d160a743e211c885cb1bea9822ce51f955664
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN++2n7DTe2:vFjzm7KxkXqKf/pUZNCgVLH2HfgsllsP
TLSH
T15C32E827944E5E7F4FD8D51CDC126F8BADF5029673780D2892FBAD0803A578A114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 40KB
SHA256 ebf886e81dedf2e624793193e87cb1f96527b5b721541dd3c745e3054fa65f9c
MD5 9cc2fdcb2b0a226accb3c639334c3ead
SHA1 6e540d16fa8e8f6fc2a5910a85118dbcdff65123
SHA512 946787d7f73e1efaeb93f1f087f51a51e7327e6e880daf0e0761548c4a4c82d796b6998b1a87cf28eac7388a62b9c0a50c67249e1a444b28ec42a32921e63252
SSDEEP 768:cRT1/Z94d9f4x0TK2lPQ8Oo3gglvaTiA9pDhfq1XHdd518XyGO1rZ7IG7Di5nJVw:iTJEUIrR5Qqchf89zG4rZ74vQlC5C
TLSH
T12B13E1590AA8E435A93ED1D2B0323C573E645CE7BB45BF52E8EE1C8C21F366C03A7521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 04200da6c386bd5f65f0f026ae4223c58e24348e3c881c8c4824af35481f1523
MD5 640ebf105e1b02641e0096d561863ac8
SHA1 1d50ccd696ceb51e7d1c22be8a401df6d0dcabbb
SHA512 4fa1279c297ca961fd8345f341a84131c8d6b9fbd3bce0d4c5c1d4172ff0f94581dac91fb241f106aa87a605cdff7ade2aae2d331cce3b79ac344c59f98de3f2
SSDEEP 96:6C0d+PTkblaRZiIEby3rUfsfuZ8IG6GGwbSl8h4otop5WFIDMB67Gwv4Y+mE1I06:6C0cTkJaRZi/CF2lSiU2K+Anq+mEmWG5
TLSH
T15EC12A31A46DA87319B2E959B0033A47CEB9326F7851AE54DEDE0F0901EB1AC1353027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 1b468e3e9c269bde7466647e22b3be7edc80c92718438bab64242c8fd221d8f4
MD5 a447849fe66da2926ce45e58cc0e9e43
SHA1 d2e1ec19afe2463ba34570fb99d13c9d5019e7e7
SHA512 59c2fdae20960729328088315e9f20869083c7b131dc6ba92e654a60c3cdab54ef1e5b80dadf82a17db0caed67ae816796cc30ed4f6df16ef37c4de7de4ce819
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5WFADMB6xGyv4YR5gGObETev4a:TC0cTkJaRZi/CF2lIDUDK2AZIR5gGObV
TLSH
T1C3A13B3264659DF76976D989F4423A43CFBA722B7951AF84EDDD0E0C18FB0AC1342027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download