hxxps://us06web[.]es/zoom

Resubmissions

27/08/2026, 18:35

260827-w8dw1scp7y3

27/08/2026, 18:04

27/08/2026, 17:38

27/08/2026, 17:38

27/08/2026, 17:38

27/08/2026, 17:27

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us06web.es/zoom
Sample260827-v1tf3ayfnc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3796	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323252805475113"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1964	chrome.exe
1964	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe
Token: SeShutdownPrivilege	1784	chrome.exe
Token: SeCreatePagefilePrivilege	1784	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe
1784	chrome.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3400	1784	chrome.exe	86
PID 1784 wrote to memory of 3796	1784	chrome.exe	87
PID 1784 wrote to memory of 4280	1784	chrome.exe	88
PID 1784 wrote to memory of 4280	1784	chrome.exe	88
PID 1784 wrote to memory of 3820	1784	chrome.exe	91
PID 1784 wrote to memory of 4704	1784	chrome.exe	92
PID 1784 wrote to memory of 3820	1784	chrome.exe	91
PID 1784 wrote to memory of 4704	1784	chrome.exe	92
PID 1784 wrote to memory of 3620	1784	chrome.exe	90
PID 1784 wrote to memory of 3620	1784	chrome.exe	90
PID 1784 wrote to memory of 3768	1784	chrome.exe	93
PID 1784 wrote to memory of 3768	1784	chrome.exe	93
PID 1784 wrote to memory of 912	1784	chrome.exe	94
PID 1784 wrote to memory of 912	1784	chrome.exe	94
PID 1784 wrote to memory of 2120	1784	chrome.exe	95
PID 1784 wrote to memory of 2120	1784	chrome.exe	95
PID 1784 wrote to memory of 1436	1784	chrome.exe	96
PID 1784 wrote to memory of 1436	1784	chrome.exe	96
PID 1784 wrote to memory of 4628	1784	chrome.exe	97
PID 1784 wrote to memory of 3800	1784	chrome.exe	107
PID 1784 wrote to memory of 3120	1784	chrome.exe	108
PID 1784 wrote to memory of 4264	1784	chrome.exe	109
PID 1784 wrote to memory of 1964	1784	chrome.exe	113
PID 1784 wrote to memory of 1644	1784	chrome.exe	114
PID 1784 wrote to memory of 1644	1784	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us06web.es/zoom
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa1241c728,0x7ffa1241c734,0x7ffa1241c740
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,8813816169748505965,5235882369653725676,524288 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,12529287536379198320,8496350774036401093,262144 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,13519058161069644268,8399971621150074619,524288 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3132,i,7439605428914087951,9373658008182658414,2097152 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,8128449671348184561,17265061861011072070,2097152 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,13419336878776230696,9084607376623849659,2097152 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,8625088619168955462,12629240445382301804,2097152 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3408,i,16178303855701840364,7069134331895603468,2097152 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4852,i,4153839166286763856,13093463624883609179,2097152 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,16271882707296606155,4070332253329410573,524288 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,17943616867607542762,1971575159180025357,524288 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,4458690095424097168,11210300870338584140,524288 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,15913134754330811193,12755621848147125775,524288 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4396,i,8474350178655070997,6193120048244777460,262144 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3216,i,14554543139240619137,16692161655783427967,2097152 --field-trial-handle=2084,i,15076003868659958355,6875180908087693736,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2e9cda4fd12d8cdbe555e9d225fdbe13b491b6efbe221bf9760df4ffc4144199
MD5 0354dc1bb04806d179f3d842a9b7fc6b
SHA1 fd565e82a516092ed7c21661546ce7886fe65c6e
SHA512 55f33d238bf41b9dcdc9c5e7a70d98d2d3b3197cc0dc28921b3f59dda91f30dccb276710819857dd009c6be23de7a9e75a1aa62b2246ba6b0aacdeebf6000aff
TLSH
T128E02BA9C922AC2718FD1B3860104646E740135B7F90C80F3B3DC2088FF5B3A456AC2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 32eacc17073ee3a2c28dbe2accb987f0591db9268fd394704cec2e544ca18bfb
MD5 277550576bff6f0ae4dbb685742d3217
SHA1 da211f224515d3fc27e7a6dd5d7e71512d794dbf
SHA512 ee535aed32af7a712ce056c8f87eb5e4b407e2b0745e6215ef12a1a447f89f7cc11ebef76c8fc30dba0b2957dc27cf332aae45dacd7b8d55f7d49954f769dea0
TLSH
T18CB0123028C08D21EF20D3706D9544642A340B568231131741B9007190232F5B455541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 a8f57f1c9fab09f2af500ab41c21d75e64f2bf6f0760875c3677f7010dcab462
MD5 96e7084ab2b1fe5274d1811c742ad597
SHA1 5d74377d2e59a19be28647b0ef288f6a0c59d543
SHA512 be0c4923bbc3207f4f6e30d95faa50930c2ba5b1e31ca6fbe7788e8738ca4783672270d7dc44717f8b265057cedcaa79bce3dd5b17b8b2996b09c514c6814fe1
TLSH
T191C09B3169C0C562FF60D3752D905C5437714F5FC571233791BD046198275F67E55845
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f3158fea647638fd8587cef216feab5d0a233822890daa6378e67a74a9024d2d
MD5 d8ca0200add074116ac9493bc01594e1
SHA1 0563d5c55b7b4ab726222848558b30507327645b
SHA512 e9efbad088ecc7b7d2a311a03808916b77bccb33a107d88cfe20750c9165b7b27299bed262ca56ab41cabc1078e6ffd9350fc1ff9429a8a838f26c03c90c40ce
TLSH
T17661ACF7D3E4867D891192F0AB246E2BCD690D28132C3C66C9E5AE1B63E25B1D10174F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7c501d35c7a32d5537bb2692d06f3cb209b2c3cc300efc79b99c0afb98056a17
MD5 85e924a2e02639692023f2f5eaeaca93
SHA1 565b21957f8e5e2041726366c7b29da52e3b46b6
SHA512 49c8b48b3948ec7ebdb05e751127031b95d971ee5028e5c1999ccf9785907335ac1dc955e5af6652d33cc74ae6deaeb4ec41b9a30002298a6d42f0c3dabcb994
SSDEEP 192:4RN/cqHXSgEVv7cpAPRp2qcev9BHsb+WNnRHo0Y42FpEa/+yK9VyIsnAUge:4RN/elwUXlDrw1M42caALe
TLSH
T18A42D72ABA6139BB4CDAC229F9567B13E7F5102625942DC4E7FCC92C15E76CC321B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3a480eab3c63a3c5d0a3f8674e0e55ab9794129df3a04556b8200f75ca4adeb4
MD5 c6e64adcd76a592de9a3cda3be5e38da
SHA1 f4b1b541c66679be4380fe6da2710f8e7a44b37c
SHA512 9b9d347e04bb2d2ea7c862d234550681a3c060da875ec3204a511e0dc16fa2d81c1a4ddfea741816d18f8df7867398b97ee1a7a13bd9f04039a2e79aea405032
SSDEEP 192:4RN/3qHXSgE5v7cpUPRpKqcev9BHsb+WNnRHo0Y42ppEa/+yG9VyIsnAUgE:4RN/TZw4XpDrw1M424aoLE
TLSH
T19D52E82AB91139BB5CDAC229F9567B13E3F5202625942EC4E7FCC92C15E76CD321B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 88053eca9d99822318e77d7846bff7c668fc1d133e02bc501763eeb1ac0d72d1
MD5 e0f94e1465caea7e162b3ecc13960913
SHA1 de2f55d6908144924150b00268825601e7721686
SHA512 debee472dbde619035457410d2b7629dfaea678c212bc9016fd4e2ed6ae32305a9ac833e9d4ed5f48ad180031747228b31fbc3872ad8ca2a18f54ddae236f1c6
TLSH
T16DB0124084015152C0521AF41147548CB1149F10970E170143E06936C8251548028161
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5894b9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5894b9.TMP
Size 96B
SHA256 43cc8737d05b579266699c83a5923583254b629f3634a8dadb3a9a8b54ce18aa
MD5 58ce9ac68d3cf29b22ff0784da685246
SHA1 aaa1e52ee81669e5423c67472f5d943e1f582795
SHA512 29bb47954f908a03f930254808f7824031ee6a728c412e784484a7c1792dbf007d889e8f167398d4a9a4b38aacb5dcf959072362ab6ebc721adba9718c01335a
TLSH
T163B0228AC202A203C2E203B02EC0C0C83020CFA0C20B022283F00E3ACC20A300220030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 164KB
SHA256 878e94fa8aeb27e137da05724cff02b7aebb277f7ec5a1f1a0795e87dbe63765
MD5 848acca76ee93443c83a4edbf6a1d03e
SHA1 91faec8c856325fc72ad9f461b27271f54479b0b
SHA512 c5f3317a2b6b6e5c67c39e1e64a715c4828b368e42c93ce30961ed71d37d0a433f9e322d8ba4fdf5abefda3d311a5c6970cc8669eb6bb25ec109a0987043b85e
SSDEEP 3072:S/FEE6a1uVl4FA+2l5yxAqKFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:yFia1uVajC0xAqKFmUi21rSm8uUVNSlA
TLSH
T149F31310FE93ACB3AD4C700472F53EA86C7C0A41D291C64195A396405DEF3C6ABDFE25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 0db36e38ec31802455e28e510749a49835e37e6b2d30bdd96913b8270ec8e932
MD5 8347b4dcee1ec1c4f625dc170e0e992a
SHA1 734bbccc09ffbd61d4a155bc6b507f66c92f934d
SHA512 985099d430da86942d327087d2d657eab2573577f6651286274cda2f3b93b184ba9c103fe980287cac82fa616c0a6e8a572705cd698f2d6edc9685c8334aa032
SSDEEP 3072:SDFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:SFmUi21rSm8uUVNSlzY/
TLSH
T13BC313007AE3E8F2EE5930447BEE2A149D6C4D818191C64152739D419DEF3C75FAEB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 2ad0a043e5377e68b341ae1601b118988ed57b639776f48e26bac6ee1e2e7f20
MD5 7963d479cac173a8fbd72bf4ff35b9cd
SHA1 77922bbdd07b2df90c9a149eafae7db95d6dd089
SHA512 2d32c234aa66dfe18f44557e543f50200c6a53f80e8b7e2647d345935a2db873e6ec54aa6dcc9ef8b745e7f742e779868ec395c9f779bd4fd310e581fa1c5308
SSDEEP 3072:ShFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:2FmUi21rSm8uUVNSlzY/
TLSH
T134C31310BAE3F8B3EE99304476EE2A158E684D818191C54153739D419DEF3C66FAFB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 b97ed637287c2c2bb129f2cf0d5473588b4e10a2e581faae6904cb643e6f33f3
MD5 3ed741cabe282d6d418d2cb224d589b2
SHA1 ed2ed20c978b2e95a337961ef408d5f72464b2c2
SHA512 90a298a2fb5580c369c2a0ed2c40ca1e4e7f328191637a6b730114739eb0b15fcf1c473100cdf8d71f51c1fca9f8506d56ea08e3f4b2225ee0a6ce9fd894bce7
SSDEEP 3072:SsFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:RFmUi21rSm8uUVNSlzY/
TLSH
T186C31300BAE3F8B3EE99304476EE2A159E684D818191C54153739D419DEF3C66FAFB38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download