hxxp://https%3A%2F%2Fp2ysyff7[.]r[.]ca-central-1[.]awstrack[.]me%2FL0%2Fhttps%3A%252F%252Fxha45722[.]east-us-2[.]azure[.]snowflakecomputing[.]com%252Fconsole%252Flogin%253Futm_source%3Dsnowflake%2526utm_medium%3Dappemail%2526utm_campaign%3Dna--en-all-all-no-ind-all%2526utm_content%3Dapp%2526utm_cta%3Dgrexp-html-prdt-scim-activation-no-ind-al%2F2%2F010d01a02e8371d8-613b26fc-b845-476f-95ae-758b5ff51ece-000000%2FOavlBRZ1dPxsDaeraa2kAq_QJh0%3D258&data=05%7C02%7CPravallika[.]Kanukuntla%40zimmerbiomet[.]com%7Cb303c81b8e4841f18fcc08df010ee6df%7Ce7290980632a4f65bbb21151420d7c39%7C0%7C0%7C639230835654094030%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=QsWU2SLZAZWszb%2B8%2BZQRuIIw9wR%2F5lc%2F6uQuyJcl9jg%3D&reserved=0

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://https%3A%2F%2Fp2ysyff7.r.ca-central-1.awstrack.me%2FL0%2Fhttps%3A%252F%252Fxha45722.east-us-2.azure.snowflakecomputing.com%252Fconsole%252Flogin%253Futm_source%3Dsnowflake%2526utm_medium%3Dappemail%2526utm_campaign%3Dna--en-all-all-no-ind-all%2526utm_content%3Dapp%2526utm_cta%3Dgrexp-html-prdt-scim-activation-no-ind-al%2F2%2F010d01a02e8371d8-613b26fc-b845-476f-95ae-758b5ff51ece-000000%2FOavlBRZ1dPxsDaeraa2kAq_QJh0%3D258&data=05%7C02%7CPravallika.Kanukuntla%40zimmerbiomet.com%7Cb303c81b8e4841f18fcc08df010ee6df%7Ce7290980632a4f65bbb21151420d7c39%7C0%7C0%7C639230835654094030%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=QsWU2SLZAZWszb%2B8%2BZQRuIIw9wR%2F5lc%2F6uQuyJcl9jg%3D&reserved=0
Sample260823-rdahwsstdt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4200	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319674659746737"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
4808	chrome.exe
4808	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe
Token: SeShutdownPrivilege	1420	chrome.exe
Token: SeCreatePagefilePrivilege	1420	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 3868	1420	chrome.exe	86
PID 1420 wrote to memory of 2276	1420	chrome.exe	87
PID 1420 wrote to memory of 2276	1420	chrome.exe	87
PID 1420 wrote to memory of 4200	1420	chrome.exe	88
PID 1420 wrote to memory of 2264	1420	chrome.exe	89
PID 1420 wrote to memory of 2264	1420	chrome.exe	89
PID 1420 wrote to memory of 3568	1420	chrome.exe	91
PID 1420 wrote to memory of 4148	1420	chrome.exe	92
PID 1420 wrote to memory of 3568	1420	chrome.exe	91
PID 1420 wrote to memory of 4148	1420	chrome.exe	92
PID 1420 wrote to memory of 3952	1420	chrome.exe	93
PID 1420 wrote to memory of 3952	1420	chrome.exe	93
PID 1420 wrote to memory of 1972	1420	chrome.exe	94
PID 1420 wrote to memory of 1972	1420	chrome.exe	94
PID 1420 wrote to memory of 2632	1420	chrome.exe	96
PID 1420 wrote to memory of 4780	1420	chrome.exe	109
PID 1420 wrote to memory of 2452	1420	chrome.exe	110
PID 1420 wrote to memory of 3104	1420	chrome.exe	111
PID 1420 wrote to memory of 4808	1420	chrome.exe	113

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://https%3A%2F%2Fp2ysyff7.r.ca-central-1.awstrack.me%2FL0%2Fhttps%3A%252F%252Fxha45722.east-us-2.azure.snowflakecomputing.com%252Fconsole%252Flogin%253Futm_source%3Dsnowflake%2526utm_medium%3Dappemail%2526utm_campaign%3Dna--en-all-all-no-ind-all%2526utm_content%3Dapp%2526utm_cta%3Dgrexp-html-prdt-scim-activation-no-ind-al%2F2%2F010d01a02e8371d8-613b26fc-b845-476f-95ae-758b5ff51ece-000000%2FOavlBRZ1dPxsDaeraa2kAq_QJh0%3D258&data=05%7C02%7CPravallika.Kanukuntla%40zimmerbiomet.com%7Cb303c81b8e4841f18fcc08df010ee6df%7Ce7290980632a4f65bbb21151420d7c39%7C0%7C0%7C639230835654094030%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=QsWU2SLZAZWszb%2B8%2BZQRuIIw9wR%2F5lc%2F6uQuyJcl9jg%3D&reserved=0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe48c5c728,0x7ffe48c5c734,0x7ffe48c5c740
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,435365373092567669,9502232885460482807,262144 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,13440529354382123204,13972765298735410497,524288 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,11815389430845542357,2890252225673929338,524288 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,3520358409355306126,14582786420751375972,2097152 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,15293436105108281966,15746269890115002707,2097152 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,4182113554547618329,6951048748765467431,2097152 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,4985143615808324867,1510959981699201330,2097152 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,13153008912474002890,734930412991346995,524288 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,3523314802556013239,3310994330901341391,524288 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,5695492946340328930,12398704701768838143,524288 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,3905191049984499190,12303978742652520043,524288 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1156,i,14438265356071384958,5162652359403588625,262144 --field-trial-handle=2028,i,15655463150703178555,3896062145983903627,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d52ff05fe1df3000642e8b6cf94e1a38217a6c25813b9e38cab1684dee079503
MD5 4993c09eca783b31c1a754d8236f523e
SHA1 01be97aff85ff9c5150c7338541e8446227bfe02
SHA512 49ace23d1205a2ea964921411e881407704e262aa9b1e140adb6a450d090b68202aa00df6bd9005ff026201f9614994730b29d849f5b605127c0168be7406a2a
TLSH
T1AEE02B99CD21FC2B1DFD4B1D58940A4AEE20535727A0C85B3A3C810C8FB066B16C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fba89aa87e640e451f7346f20ffd4fc8b10a8598248e6838063250f2c589be0f
MD5 8276b3e39bcf9b0b2258d840bf962a43
SHA1 4152c5825d1669701b05ab147a71f51668f5c57f
SHA512 8473da3ef4bbf9b7e21d5c18979b83d039c42dd22d42e1756b5c6c1c1109744ccfbaa07bfa5bafc0f58f2e866be211fcc82847251428695ac081f24f9a4e4b46
TLSH
T133518CF7D3E4C57D891156F4DA25AE2FCD290A24121C3C6688E4BF5B53E28B2D201B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5f958a6a7f3dec25b173dcead5694924c3f296eb537e851e3972db614b8589bd
MD5 52104cb364b76cbb02acd08ba3a668f4
SHA1 0b3110df8169300f159845ee95fb4e8343b811c1
SHA512 c255b382ddb71db120a15088a1997e874bf99dfb7e345fad426f928dee5b2dbd531c026cd69fc186e7adb9c2ee9a47bf5255fba7989132ebc9024ef30f2d081d
TLSH
T102417CB3C7E8867D890156F4B7152E1FCE290E24536C3D5AC8D4AF1F67E28B5D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 acebcbcf504ffd31891125c54565d4c27b1433a78535efed41d669be6b3e4e22
MD5 6d18b26b1731d42ba42949de15e12c49
SHA1 8a374ba59a3f7a3f90e825130658285de304ef2a
SHA512 f5a9514c20a31bf05cdac71a1c574a2b393f1580ecceadbffc29442be9a2f767dcfc237dea32b4e8962cb354378424b5f6274f8c66e36ab28e36d9f0c6df8c4d
SSDEEP 192:ARliQ2lSrHr8jFmpv7ApAPRp2l9qHsb+WNnwIyrC0VMX20548wVyIsnAUge:ARliqLXpkUXmkwwNC0VS2054fe
TLSH
T13642B62EEE00693BACDBD225FA667B63D7F5102624902E80DAFC892C15E75CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 05d6a2eee933f76b64817506f3703e22397137d27ae843a3ba45a1bbc22fd231
MD5 b74476807e869955914815fcb195ae6e
SHA1 4aac2f12dbf9e35d4feb79a2a84567b533acd7da
SHA512 7f533724902ab0bb0e5eaf4be6f5f629224f770e44407035af01e4c4c1e8c71beb898ae2d4173649d3b5cc36cb98c4b0d838ffbf3d7405c9350442a28b0454da
SSDEEP 192:ARliQ2lSrHr8jFmLv7ApAPRp2l9qHsb+WNnwIyrC0VJX20548lVyIsnAUgE:ARliqLXzkUXmkwwNC0Vd2054EE
TLSH
T18642B82EED00697BACDBD229FA667B63D7F5103635902E80DAFC892C15E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 6e71ad67649eceba9dceacc5579f63592b30a0fe3d4ea5c3714b1113e80ce77a
MD5 23d07449a87f7f427d0002cbd13f4527
SHA1 5ba977adb5f243886166f5de6b223fee0429e9fe
SHA512 3db6bb93246e0df7580e6ac021306772eb6ae3c94e692189f321a5f442596ba0c6e90b6962d8752236e094ba176547630cbde8a065a681a293da5241803f913c
TLSH
T12CB01240C0019151C00706F816421888F158AF11970E2F0253F0AD6398255918014061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aec9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58aec9.TMP
Size 96B
SHA256 1b4980a930e23b6d13627e5e461816a54c75c42b932129c0f6e77121f7935415
MD5 3d8ced6c351118e0541ee0f5de14b93f
SHA1 0a57a58fd70a583f10c4781567b8062f83eae0a4
SHA512 6ed800df66f549cb08d4b7fe445d96aeb2959fee9f9c3f3170defd9bde07f1ca9f629e80f80017a49a59384511e9f9d792b5b5adc5bbf7e9e4d8edb61c1b7e46
TLSH
T19DB02200C2023B0AC00383B02880F0F830A0EF23C203230A83E08EAAEC322A000200A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 86608e0d05b1e47701eda50ecee165f2b70ad5e83587c5d52bd83e74626cde4b
MD5 22b7792c9585fc46c7604e9884112256
SHA1 a3ab83a9262ddbbc3706c958c27f51a0d16fb57f
SHA512 0fb4bca21489b4b61dc9c03414d5037eff3cba5c3799c56d5925fac2d13deb7b738ec4bd0b322bb8c447e112c6ea03901eaf5c5a4f5c1ca31cc83194c445a100
SSDEEP 3072:xAGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Zm7Rkm1tYpBeh2BAog
TLSH
T156C3123B5D74E8375DB5B71EA04E0A1F1EF249A7C920DE92C8D85B0427E97CD0A49E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 156KB
SHA256 77ed18bb7e5f4108a40743fbba52c2720fdc6bf9f67868a014825f182582f78b
MD5 89f514a6a4e4aec9a0745cc8f12c457d
SHA1 6b95c78e908527aabece601097704d99a3cee100
SHA512 846ebb7263cacc96f3ea425ce02a676a6e978af2cdcf98b891db6a260e8fafa21ab7ac31f9bf4778f58d14f3950753b13a3964c166c43d0c121a2e1e1282d03b
SSDEEP 3072:cAD6AsHnKI/Io1Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:JD7stIxm7Rkm1tYpBeh2BAog
TLSH
T14FF312399CB5A93608A4E75EA04E0F0F1FF246E3CD11AFA1C8D86B4037FE6991A45974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 01a091f4c296214a36a918c28c4f38516010f86de13e697d351d5b6ce6082ab3
MD5 a25b2f4e1802fd46934040a2407a185d
SHA1 e3ee231e8f35008a7b9578e8c1421f9fb7d9a963
SHA512 53f1bedf2c46a967183451b9d79f72a1e041cff063bbf7e5b86557aee2832a1f6e7ec29b3e5020751ad13fa2528237a19aec938c5741e035d941809a88460257
SSDEEP 3072:A9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Lm7Rkm1tYpBeh2BAog
TLSH
T12FC3123B5D74EC3B5CB5A74EB48E0B1E2EF149A6C920DE9288D85A0437F97CD0A44E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 054846b62cba718658f342081d460dde95121c8c7e5a54b6f8a65dba086b5f36
MD5 0cf76506b0664f2896c116655fda0896
SHA1 bc9757246d5b117e8e0a96d21035f7f7420b264e
SHA512 7631fa6dc4e1b4f6e725f81bd90b61f31afdebe69bc74c97855bbe2f09b670d88d841a3e60527e70b9fc750c5e0711357ba07fc6be3c0168f47d318b1220ff96
SSDEEP 3072:cAGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:im7Rkm1tYpBeh2BAog
TLSH
T199C3123B5D74E8375DB5B71EA04E0A1F1EF149A7C920DE92C8D85B0427E9BCD0A49E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download