cdcc4554f6d0fd71e638bd4b011b50aae18bd20c3ca5af21c76f2e3697012a9f

Analysis

max time kernel
119s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
redline-terminal (2).html
Size 33KB
Sample260702-2nekpsfz41
SHA256 cdcc4554f6d0fd71e638bd4b011b50aae18bd20c3ca5af21c76f2e3697012a9f
MD5 7759a5d96683ccf5e7946bbf40351f99
SHA1 9e8bc2432591e729261e4d70073eaca5cec416da
SHA512 290eb0d527183ecc32f7c31cabd902625324b2df1a2fece1d0b71ae1fdad40ef048ee75c2dfb430c77be68c1cf4e870416b9dc991fbd161a893311cc82aab04e
SSDEEP 768:0V73M2P5946HlXj26x/td4emtTZMqvfVGZ:T2h91px/vRg1M8VGZ
TLSH
T193F207297671107196B393AABBC7D30EB62180079C11D96478AD4050CFCEFE6A5FFAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4844	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275058201106685"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 2440	5220	chrome.exe	89
PID 5220 wrote to memory of 6800	5220	chrome.exe	90
PID 5220 wrote to memory of 4844	5220	chrome.exe	91
PID 5220 wrote to memory of 6800	5220	chrome.exe	90
PID 5220 wrote to memory of 6164	5220	chrome.exe	92
PID 5220 wrote to memory of 6164	5220	chrome.exe	92
PID 5220 wrote to memory of 5904	5220	chrome.exe	94
PID 5220 wrote to memory of 4672	5220	chrome.exe	95
PID 5220 wrote to memory of 5904	5220	chrome.exe	94
PID 5220 wrote to memory of 4672	5220	chrome.exe	95
PID 5220 wrote to memory of 1628	5220	chrome.exe	96
PID 5220 wrote to memory of 2400	5220	chrome.exe	98
PID 5220 wrote to memory of 2400	5220	chrome.exe	98
PID 5220 wrote to memory of 1232	5220	chrome.exe	99
PID 5220 wrote to memory of 1232	5220	chrome.exe	99
PID 5220 wrote to memory of 2192	5220	chrome.exe	102
PID 5220 wrote to memory of 2192	5220	chrome.exe	102
PID 5220 wrote to memory of 6668	5220	chrome.exe	103
PID 5220 wrote to memory of 6668	5220	chrome.exe	103
PID 5220 wrote to memory of 5944	5220	chrome.exe	104
PID 5220 wrote to memory of 5944	5220	chrome.exe	104
PID 5220 wrote to memory of 1900	5220	chrome.exe	105
PID 5220 wrote to memory of 1900	5220	chrome.exe	105
PID 5220 wrote to memory of 2044	5220	chrome.exe	106
PID 5220 wrote to memory of 2044	5220	chrome.exe	106
PID 5220 wrote to memory of 2056	5220	chrome.exe	107
PID 5220 wrote to memory of 2056	5220	chrome.exe	107
PID 5220 wrote to memory of 5132	5220	chrome.exe	109
PID 5220 wrote to memory of 2608	5220	chrome.exe	110
PID 5220 wrote to memory of 4788	5220	chrome.exe	111

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\redline-terminal (2).html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff8a4d2c728,0x7ff8a4d2c734,0x7ff8a4d2c740
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,18359012480790439712,3123763042310051867,262144 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:6800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,7844687121046983456,4066139114193998282,524288 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,5657858721278433836,17992679248985387015,524288 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
  2⤵
  PID:6164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,8032253664256648000,10101639409861048837,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,13655361132494545431,10053855344914743515,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,10563079361360692684,12515241385419414217,524288 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5228,i,4682868664306340578,15577716082999967449,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5276,i,692511803395140285,16909224124828491646,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5212,i,5202229326657905347,10482342132233081664,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5716,i,3066567622444957096,1768778100236567461,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:6668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5348,i,9992801476301317670,15135336520918212953,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5880,i,14145354857035902994,908789899058569128,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5452,i,3325694072653648251,2345399621565320752,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5852,i,9290135307969979250,5366462009552457979,2097152 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,6452184916413174960,16368278403474936279,524288 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5296,i,10391707491229189450,9151151860934413004,524288 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,4326991978770727911,7273472280021754903,524288 --field-trial-handle=1904,i,5473793798903312488,12855938359451921279,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:4788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4337019f287a2557f00824df12dea9b8248c9f3cebbd0ab64d4f175f059737b2
MD5 1a918004cd0f83337030fe979cc16d7c
SHA1 7d4f6d1a4095d9756a072d887c9d5ecf251e9495
SHA512 7f1191be0a2e148c755a1c559620ca9d7358a37e221447ec59957388358a1e925f92401e1c5051c988c8d12a2fcc096e8ca716fa80f596f8da269aeb9f35a14f
TLSH
T1CD517FB7C3D8867D890151F8AB256E1BCE2E0D59532C3C56C8E4AF5F67E2871D21018F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 fbd5bbcedd24e8c6eee6cc2a19e1885135b2657e43429cfc48a7352f5475a9c7
MD5 19cfb08388eb62f4855cb3bc106b9523
SHA1 d09a24f4d363125aca1ac787e512abd154e3b8ed
SHA512 0e3bbb85e91343587024aa47c11cf26118531cc2c5280ab9ac6710fc07a13e95078f9eff87bbcc6af7316690aee6b191765a12046330d43cddd5547fe17ac168
SSDEEP 192:uRRbzbj/v7SvAPRp2q/90Hsb+WNn+GhWPul+qzeZ+VyIsnAUge:uRRbzvXm6XD+wyPV2e
TLSH
T1E732972EAA14757B6CCBD22AFA25B793D3F5102135942E84EAFC8A2C15E75CC2217437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3c9e945fccaf8a19dceaa99c0c2ded45f52462a674ca300a29cf211df8225f85
MD5 cd14ecb39b7a023dc2e29c70bf3454c7
SHA1 38cee874b9535d8cbbb6c767635057c3e37e8f57
SHA512 010f1669d01afd79b81091b22be6abdf92312f8dacbe9ef61a9b92750684a572f91652b07b7c21958ac8298355f2ec2c3e7ac362e5a7308a467cc2f93dd75116
SSDEEP 192:uRRbzbj/v7SvRPRpBq/90Hsb+WNn+GhWPul+Rzezv+VyIsnAUgE:uRRbzvXmRXy+wyPg2E
TLSH
T11632B92EA910797B6CCBD629FA25BB53D3F5102125D42E44EAFC8A2C16E75CC2217037
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 1f848aa688155e2ab615738bc843daf6b8f14bbe671c3a4a784680704b5380e7
MD5 10ccaaf62ee6d4ec29f4177d6665def8
SHA1 82deee07efabfd40c9390d449016ca562478ffb8
SHA512 f0d1e38a67e09212352a7a9741e55de40141832ee866430ee521bb33e60e4adb2bfb8a3c22df3fb9033e82d440dc9916e6d3230fda7a079502c34422a025808d
SSDEEP 192:eUX4K6qs7KxkXqK4I40pUZNCgVLHrKHfFKslEmbQ8OXzKD/h0+ErUkKN9MbjWFCd:lXj5s7KxkXqKf/pUZNCgVLH2HfgslTOd
TLSH
T13B32E827A88DAE7F0FD8D509D8167F4B6CF5429276680C2856FF9D0803A67CE114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 5b0f4071e8823e4c2afce532d81607b3aad4ea9ca83ef794adbb214c4e998470
MD5 d3f2d29fd05a5e6286837e6523cda9e5
SHA1 f59c240a4164b543b3fed60dfb5d4d2375008858
SHA512 1afad8e836506887fea81b3149b3f1300209e8fa9966a82985f131a0469e35f56a882d1eb9759e0944a5bf83d1ba9ffedb1100397903c5bc76bc50f126e440f3
SSDEEP 96:nbJ6Wd+7S3YGHwmkwufuxZnI8nVmUSl8h4otop5tlDGB69GyvMbFMH+K/TJRNC3r:ntFsSoGXxZI8XiU2vWtNMH+K/9uCacUV
TLSH
T12EC1F975A46D9C7B49F5F486B1032E438DB8209B6964BE68EDEE0F0C02E75DC4343223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1a5186b7f186c97937637a14b57457c96550cdd87d606d193bdbbbde5f6b21be
MD5 35afcc66a5cbe3fbe750b3830351a73e
SHA1 ccd6b28d8fe50a62ea72f9805ae6868fb7ccbf70
SHA512 de1a9a310154b13fa4027154887b5419965afd792e7bd95457b0d60c53efdd1114046800e9d2a9720e9ca4ef109dae5fba45012510febc0809a77992b9c0ab1d
SSDEEP 96:nC6Wd+7S3YGHwmkwufuxZnI8nVmUSl8h4otop5tlDGB69GyvMbFBB151VaA9+K/2:nCFsSoGXxZI8XiU2vWtNft9+K/KU38
TLSH
T1E7C11A35A85DAC7399F2E546F5032E87CEB460DB69609F98DED90F0C02EB1EC1342227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 80d415ee10e9b1aa356a4d1e03d91dbfe477064f1360114838d3ebd287758c64
MD5 f4d3282c5f43443b42b1740bd04296fa
SHA1 664433da403167ed7700a6e61c57f468952bf385
SHA512 009a6f48f9092da7290885ca520607ee0f766c024107a270c9e8d234fb7c9bfa042eeb3090753ad75f3a41bb84ceba4e9fa478912a08ad87bfcea10ccfe3a977
SSDEEP 96:nbJ6Wd+7S3YGHwmkwufuxZnI8nVmUSl8h4otop5tlDGB69GyvMbFBB151VaA9+KO:ntFsSoGXxZI8XiU2vWtNft9+K/KU38
TLSH
T1F1C10A35A85DAC7399F6E546F5032A87CEB460DB69609F98DED90F0C12EB1DC1342227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 6f4a3c0a62ac8c1fc09589f7cdf848cead08252d28494f57b949e9afe1225afe
MD5 93db9a63c7edb434053eee17ae45ab63
SHA1 79e826e2b47982bed852ddb9d6a19cb10466a79d
SHA512 6255cddcdbf3a567d91ef8b6a69dc3cd8addb7f13c4fa59436120f9b6ee9d5057b5b190ac8429f8a9500c1a7e551b9e7188af428e42bb23a89af11e061c7284b
SSDEEP 96:jC6Wd+7S3YGHwmkwufuxZnI8qBmJRDotok5t9DGB6GGyvMbP7/cfbvpE69v4a:jCFsSoGXxZI8jDUDrWWn7/cfbRE6h
TLSH
T1ECA12A31B869AD3795F5D485B9523B43CEB8609BA960AF989DDD1F0C16F71E81302223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download