hxxp://chrome | Triage™

Analysis

max time kernel
900s
max time network
897s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/11/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://chrome
Sample261110-vhevysbz21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4376	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-338007942-693956180-937915117-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4788	chrome.exe
4788	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe
Token: SeShutdownPrivilege	4008	chrome.exe
Token: SeCreatePagefilePrivilege	4008	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe
4008	chrome.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 3904	4008	chrome.exe	80
PID 4008 wrote to memory of 1296	4008	chrome.exe	81
PID 4008 wrote to memory of 1296	4008	chrome.exe	81
PID 4008 wrote to memory of 4376	4008	chrome.exe	82
PID 4008 wrote to memory of 3420	4008	chrome.exe	85
PID 4008 wrote to memory of 3420	4008	chrome.exe	85
PID 4008 wrote to memory of 3204	4008	chrome.exe	83
PID 4008 wrote to memory of 3204	4008	chrome.exe	83
PID 4008 wrote to memory of 4816	4008	chrome.exe	84
PID 4008 wrote to memory of 4816	4008	chrome.exe	84
PID 4008 wrote to memory of 820	4008	chrome.exe	88
PID 4008 wrote to memory of 820	4008	chrome.exe	88
PID 4008 wrote to memory of 4528	4008	chrome.exe	89
PID 4008 wrote to memory of 4528	4008	chrome.exe	89
PID 4008 wrote to memory of 3544	4008	chrome.exe	90
PID 4008 wrote to memory of 5524	4008	chrome.exe	92
PID 4008 wrote to memory of 5524	4008	chrome.exe	92
PID 4008 wrote to memory of 5720	4008	chrome.exe	93
PID 4008 wrote to memory of 5676	4008	chrome.exe	94
PID 4008 wrote to memory of 5628	4008	chrome.exe	95
PID 4008 wrote to memory of 328	4008	chrome.exe	96
PID 4008 wrote to memory of 328	4008	chrome.exe	96
PID 4008 wrote to memory of 4580	4008	chrome.exe	97
PID 4008 wrote to memory of 4580	4008	chrome.exe	97
PID 4008 wrote to memory of 4788	4008	chrome.exe	98
PID 4008 wrote to memory of 5880	4008	chrome.exe	99
PID 4008 wrote to memory of 5880	4008	chrome.exe	99
PID 4008 wrote to memory of 6040	4008	chrome.exe	100
PID 4008 wrote to memory of 6040	4008	chrome.exe	100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://chrome
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff2017c728,0x7fff2017c734,0x7fff2017c740
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,16830985426572520577,7296071038546008567,262144 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,13002085775396976546,4218110947080866750,524288 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,6729497417965763342,17839027096902254429,524288 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2484 /prefetch:13
  2⤵
  PID:3204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2944,i,5213335152241283559,14001101314751245199,2097152 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2972 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2936,i,14760079461182472131,1869520505293846242,2097152 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2952 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,11742090417246116143,10202933538362957674,2097152 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=2984,i,5607673483483888036,10387500246060587491,2097152 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,16548347840133906088,3640379295702293883,524288 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5336 /prefetch:14
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4620,i,10144943598153815181,15695730991869758686,2097152 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,12252634845363651059,8272561248431335995,524288 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3164 /prefetch:14
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,7328901633461409795,9868731394035185816,524288 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:5676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,9872622138135637168,3625803678984640061,524288 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5344,i,6729536913378012236,15439229769397449876,2097152 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4892,i,14829571658641563132,2351307536085619094,2097152 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4800,i,4841535121564996869,10429903436091072939,262144 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4828 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4472,i,5013700781332442559,5458760800682860601,524288 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=1524,i,2365087594139618314,4790916205536824395,2097152 --field-trial-handle=1952,i,2620430636372202222,3968103630192491957,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:6040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

08289e3c-1cd9-48a9-9f56-e91fff8a4fc6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\08289e3c-1cd9-48a9-9f56-e91fff8a4fc6.tmp
Size 131KB
SHA256 3485194b24a450f1cf7729feb0f2426a0b9fe237563b650001a88ace7d7943ab
MD5 6498d13fe74d1174577ae410aea4a2a6
SHA1 f4b12a77a66ba5f2eaf80db5d98714a8fe4415c6
SHA512 8a3078085105d6cf529c4f2c57d1061036dc42ad483b82b576682e89702c6d0b27c196bdb5374d15e99802d207824771ab15676b18dfd019884257113a4217ec
SSDEEP 3072:fhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:fxmX/B5UgKf2ne1utL1
TLSH
T152D302BE9CDDEFA36392B026A9A91B5BC9F67FC89160DF4081F01185009F1BD43D9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7396a18e-48db-4636-a70c-a4b46ed25c30.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7396a18e-48db-4636-a70c-a4b46ed25c30.tmp
Size 131KB
SHA256 652da6c129da0932ec40d057dc327f48b2c33ef127ecb1d60a426e075334063e
MD5 8e8673f5e1ef75f0c68ca804d357b690
SHA1 f8b1ba23caab410da71c83a69cc9507473c663cd
SHA512 ef5c2580832463563bbf0900211759fd1cbaf36030d36e7b36ad9726558077b966f8dccd77bcbd35edbc7a5dd2e9a751c5d0e0f1fef1f89dac7ca07b82044532
SSDEEP 3072:yyhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:yyxmX/B5UgKf2ne1utL1
TLSH
T1C5D302BEDCDDEF9363A2B02669A91A5AC9F67FC96160EF4090F41085009B1FD83D5A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d432f1c-0a8c-4b8d-a928-8c7258cd2cae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7d432f1c-0a8c-4b8d-a928-8c7258cd2cae.tmp
Size 130KB
SHA256 f8aa1e628c5278cd4a009acfea726f7e5485ebcff2850e4337676854c487cd9f
MD5 abcf5cca862591f07e637811ea19abcc
SHA1 ad3eb6350f43d8ddb668e9eddcd3c861eea4c1e1
SHA512 db450fad13ae028a33d531fad87ab6e7a426298b5b068661abff02c408da2a449849b6c56618e71a13254533a8292a4ae7ad40195a78a7f3138436deb083f938
SSDEEP 3072:GhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:GxmX/B5UgKf2ne1utL1
TLSH
T1DDD302BE9DDDDFE36351B026A9A95B6EC9F67FC8A160DA4080F41085009F1FD4399A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8956a6e3-91b7-4c71-9259-22b7e73118b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8956a6e3-91b7-4c71-9259-22b7e73118b1.tmp
Size 132KB
SHA256 6cdf824e6cfc381dabea653c66b4d8c67a7f5ac890f4612eaf6f2e2ce5da97a2
MD5 9b837b2fbc3c2525b42f6a5db4e1da28
SHA1 e8bc4b9b1ef3d73413c134d2721e4b0741164c53
SHA512 25757051c5c190cf303b6bf156b68f03eb656f45456ed6c44db82e9434fac083062a729f000fa4749137e8748802443230a074271694ae916362a03952e5f724
SSDEEP 3072:iyhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:iyxmX/B5UgKf2ne1utL1
TLSH
T14AD302BEDCDDEFE363A2B02569A91A5AC9F67FC86160EF4090F41085009B1FD83D5A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

243f6af8-f296-4544-9355-f5bdfef92781.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\243f6af8-f296-4544-9355-f5bdfef92781.tmp
Size 414B
SHA256 c5ac1d5095c1a93cb3d83668ea8eaecff323ed75975526fd699bf3de079299ee
MD5 b2a96fdd136e9abce90926e2493bb38b
SHA1 a48e25d678c408e3e9a200bd208f7584398574f8
SHA512 9310b49d1036d30d97a54fa362bafdc5302bd5c22bf6dfeb29f409aa9f796a2f503ace0823bb312973e2a60a375efe520ded97d01063c366749612fbd3f35fbd
TLSH
T1F8E02BBDC965EC3715FC0F289214574AF74123162A518E4F3B3DC11D4FB163A4685DAC
MD5 SHA1 SHA512 TLSH

Submit Download

55183c2d-f1fe-4c02-9b7f-57c5427dc392.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\55183c2d-f1fe-4c02-9b7f-57c5427dc392.tmp
Size 11KB
SHA256 177df49c97cd1f0fddf003641747ad9935eae6ff02920849f39eae364b15d1d8
MD5 b4dc07aeee754112161340414c39681c
SHA1 29a9db0b5df3a034b0cce64026024db8c0c98f91
SHA512 ac3aaf76b9493f5adcaa901ac03e62178a753c79534952e7fae189590afbf65594e52300330682dbd1f3b413eeeab15e21fc2451c2209fc1ad7f990a62172930
SSDEEP 192:WRIGsPpxv7+7pAPRp2Mo9ZHsb+WNnjjUPN9IinkwQaL4VyIsnAUge:WRIGcphS7UXubw3UPNvnwaQe
TLSH
T17142C62DEE14743B5CDAC22EF9617717D7F6102261D52E84E6FC892C20E76CC221B127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64c3a83e-8516-41be-8d76-f455842d81b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\64c3a83e-8516-41be-8d76-f455842d81b2.tmp
Size 12KB
SHA256 31e666c97b87bf0ecec1628ba491274536b149cb40ca8cca48f745e7d648ffa5
MD5 49575f41e5214ac2a62c2e5d78a01797
SHA1 cfd95b2271b0f5d386e26a6f5ed11386cbe95dc1
SHA512 55130f8149191fbfee9000b489ac432572105e85f267817bd4aa4f9495878dca5ea51e1fcaa0442d2a752d8245fa7f8064426f8dd19c7a98fb777e8cba6c9fc5
SSDEEP 192:WRIG8Ppxv7+7paPRpwMo9ZHsb+WNnjjUPNXIinkwQaL7VyIsnAUgE:WRIGMphS7aXkbw3UPNlnwa5E
TLSH
T1EE42C52DEE14743B6CDAD22EF961B71BD3F5102225912E84E6FC892C21E76CD221B127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97ebc84e-729b-411d-aac0-ca6f38def376.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\97ebc84e-729b-411d-aac0-ca6f38def376.tmp
Size 13KB
SHA256 cbcfbe27999bbf1c38c32cf734dbc58c0c74e8fb94cebfe52fc4ac99ec4b2c4e
MD5 2687abbcac7af17c0b616b501e486b1d
SHA1 baf57c5410325446dd74e61be138853be50fcccc
SHA512 d6063c76c0f9513dcd556327052394a8fbae929daff68178795f4017c88a3a038bc8b09526fadfd4132488a9d51a09e3cd9ab6243430667f2c455f48c796d43f
SSDEEP 384:3hjb67KxkXqKf/pUZNCgVLH2HfgslxwXODb++ErU3l6HGjOoAWI8n:3hb67KxkXqKf/pUZNCgVLH2HfgsP6OPJ
TLSH
T19152F867A84D9A7F0FD8C94DD8266F4FACB5015766680C6893FB5C0803E5BCB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2df558c6-2119-41e9-a8a9-a4c5fdce5794.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2df558c6-2119-41e9-a8a9-a4c5fdce5794.tmp
Size 519B
SHA256 3af81bedebbdd6edece6a97b08784e88b2662dc17fad3e58a1f291330c7b7fcc
MD5 d12c1bb34928218186cbdce529cbda1c
SHA1 277ae3bfee2f40f8776e84648d9dc5ab5e0d4bae
SHA512 524d154a1e02c33c6acffc1e98a98719fcee4e7f83f93515d90bf9922b81458377193ae6477bf8086af43201fb7b416cb8c67d61c08496268becf239729b6fd9
TLSH
T150F059F7E6BA746340BAC57F1F087C0A56B2A831024128E5CEAB822D90E58E70B02453
MD5 SHA1 SHA512 TLSH

Submit Download

577f1f3e-b519-4d4b-9302-b197d0453a83.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\577f1f3e-b519-4d4b-9302-b197d0453a83.tmp
Size 1KB
SHA256 e8b92eccc47aa45efac8acc545f4b3e1ed76abaa64b0ce0bf89d952b6ed72003
MD5 0019e9b105f7cfde1aa6158e1a24ce37
SHA1 2b0eab7de937123543a9287998d4b4f1280b0c90
SHA512 03d5b6307ab3c2c4fc11f6256c68ecc9ec348ba8c041b6c711bfbeb5907f3aa42b218c9d1421e4486e5cac09dde7e1f47e30c99d43e41be68f171f0921492dac
TLSH
T16431CEF793B4857D9A0186F4EB116F1FCE6D0924032C386688D46E1B83F2872E14078F
MD5 SHA1 SHA512 TLSH

Submit Download

5d9c2721-1765-48a8-ae47-cfbe4489d3ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5d9c2721-1765-48a8-ae47-cfbe4489d3ca.tmp
Size 1KB
SHA256 6358642e7975b94f40706a32d801a99f880346a3d4bcca026cb8e1d077d3827d
MD5 260975102005f3c12fc761b828b7f599
SHA1 77df3c708b66699d963d267965aba3c6f5d5f41b
SHA512 57070dc44f0c135d55ccdeef11da22c3e45aa3df7663836cc97f9720767a3f2c8f715faab015a1e3ef8c90f205df97a3096c543873c641ee893975aa7f8f69e1
TLSH
T104317CF793B4857D8A1096E4EB15AF1FCE6D1524031C387688D46E1B83F2972E11479F
MD5 SHA1 SHA512 TLSH

Submit Download

c8d16d80-a6ef-493a-a782-387a2c391695.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c8d16d80-a6ef-493a-a782-387a2c391695.tmp
Size 1KB
SHA256 bd2d769182a7becfe32388e5a5dbdb61634afd0a08e5392656f8cbadc56946b9
MD5 161e28302f4b905ad970a1d5931667d9
SHA1 55d2f71e55ebf3d24d44c03449e7aca4c80c9139
SHA512 74649df43cf0d4a594e04d45a73dfa35524ebebebb2ddfee24713f830b2b76ed01b56a1cacd643dcccde628bbb8000970d8708d48f348cfdb91f2e51415a3a48
TLSH
T1F83179F793A4857E8A1196E4EB11AE1FCE6E1624031C386688E46E1B93F2872D10479F
MD5 SHA1 SHA512 TLSH

Submit Download

db36fb02-4b88-4027-85fa-3b6204fb7a28.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\db36fb02-4b88-4027-85fa-3b6204fb7a28.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f6f147a4-7caf-44cf-a45b-2688fcf094ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f6f147a4-7caf-44cf-a45b-2688fcf094ce.tmp
Size 1KB
SHA256 2a3432d132c62a4f48ecc40565fccccd36fe8a1954ba0d433ceea84e843107c8
MD5 e90e153ea4dabc4f44f9e0c0e24ae13d
SHA1 0a15d661dae19862abb96b222e6d5c013d478b06
SHA512 b82d03286df21c8efe8b579a474b778c1076e89a18f456a85fe90cf15e362c98aed9e1bdfc79f02890a48e4399eea07f6eade26e0c1f09eb435edc8368c11389
TLSH
T1A531AEF793B4857D9A1196F4EB156F1FCE6E0924032C386688E46E1B83F2872D14479F
MD5 SHA1 SHA512 TLSH

Submit Download

a4497298-4989-4c24-bc2f-2bf30dd7e2b2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a4497298-4989-4c24-bc2f-2bf30dd7e2b2.tmp
Size 12KB
SHA256 d9b15b9aaeb6f40c78e45dce83b222bd98cd7542b7fdad3b4dabf4e15f367937
MD5 9d212b31e339b7ebf1561fc3d8112d87
SHA1 1ced0eb32ee554d6a8df841a0e87cbf8b1095226
SHA512 2a4b42f4ac7db865715466c7aedc376c61586562938b46d34e77d0a432f2f793c3490f5af60ca04873bfd198e07bcd918a89797c2bd0acb76eb3ef230b7a186c
SSDEEP 192:WRIGsPpxv7+7paPRpwMo9ZHsb+WNnjjUPNXIinkwQaL7VyIsnAUgE:WRIGcphS7aXkbw3UPNlnwa5E
TLSH
T14442C62DED14743B6CDAD22EF961B717D3F5102221912E84E7FC892C21E76CD221B127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2d7f9eb-87e8-4548-883d-c9f3285923b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b2d7f9eb-87e8-4548-883d-c9f3285923b1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c8550dc4-ea4b-4140-be65-4dcaaf700544.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c8550dc4-ea4b-4140-be65-4dcaaf700544.tmp
Size 131KB
SHA256 050526d542b464200c02e7c78f3380ff6694e3e93bbe36ddd6d44e17b46cb3eb
MD5 ccb73df257fcf1c48c74c5b70abdab41
SHA1 6f7b1389a5e9d27f37a7f15d4def3ea308607a3a
SHA512 5925bb3a80648cd957b6f3c37d691f905df56f349909e127b6085e1771d62db48499653bab3b4981590053f05db1621e9c08907cdf4ddef17382931822e27759
SSDEEP 3072:OhgYVmX/M9F03bZTGnbgKfHWuoJqrAKrpQpbOYg3xC1:OxmX/B5UgKf2ne1utL1
TLSH
T100D302BE9CDDEFA36392B026A9A91B5BC9F67FC89160DF4081F01085009F1BD43D9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download