Analysis
- user interaction
yes - max time kernel
900s - max time network
427s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/07/2026, 02:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://gofile.io/d/XjEDQC
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
23 signatures
900 seconds
Behavioral task
behavioral2
Sample
http://gofile.io/d/XjEDQC
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
900 seconds
Behavioral task
behavioral3
Sample
http://gofile.io/d/XjEDQC
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
13 signatures
900 seconds
General
- Target http://gofile.io/d/XjEDQC
- Sample260701-cl2vsaet51
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 26 5072 chrome.exe - Executes dropped EXE 1 IoCs
pid Process 4860 run_me.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 api.gofile.io 11 api.gofile.io - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\run_me.exe:Zone.Identifier chrome.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5072 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "250" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273454646571852" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\run_me.exe:Zone.Identifier chrome.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2480 chrome.exe 2480 chrome.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 440 Process not Found 2552 Process not Found 1252 Process not Found 912 Process not Found 1020 Process not Found 2936 Process not Found 1540 Process not Found 3152 Process not Found 2840 Process not Found 2856 Process not Found 2988 Process not Found 5116 Process not Found 3836 Process not Found 4336 Process not Found 2460 Process not Found 4816 Process not Found 4384 Process not Found 2712 Process not Found 4536 Process not Found 1192 Process not Found 1488 Process not Found 2864 Process not Found 3360 Process not Found 3824 Process not Found 484 Process not Found 4612 Process not Found 3464 Process not Found 4864 Process not Found 4312 Process not Found 576 Process not Found 3860 Process not Found 3444 Process not Found 3296 Process not Found 1832 Process not Found 2140 Process not Found 1768 Process not Found 4456 Process not Found 332 Process not Found 1176 Process not Found 4432 Process not Found 3432 Process not Found 1100 Process not Found 1248 Process not Found 1896 Process not Found 2848 Process not Found 4104 Process not Found 1844 Process not Found 3176 Process not Found 1304 Process not Found 3324 Process not Found 1668 Process not Found 3588 Process not Found 1288 Process not Found 2072 Process not Found 4964 Process not Found 4532 Process not Found 2932 Process not Found 4724 Process not Found 2172 Process not Found 4940 Process not Found 3968 Process not Found 2772 Process not Found 5032 Process not Found 4296 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe Token: SeShutdownPrivilege 2480 chrome.exe Token: SeCreatePagefilePrivilege 2480 chrome.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe 2480 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1492 LogonUI.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2480 wrote to memory of 1744 2480 chrome.exe 81 PID 2480 wrote to memory of 4052 2480 chrome.exe 82 PID 2480 wrote to memory of 4052 2480 chrome.exe 82 PID 2480 wrote to memory of 5072 2480 chrome.exe 83 PID 2480 wrote to memory of 3232 2480 chrome.exe 84 PID 2480 wrote to memory of 3232 2480 chrome.exe 84 PID 2480 wrote to memory of 3264 2480 chrome.exe 86 PID 2480 wrote to memory of 3264 2480 chrome.exe 86 PID 2480 wrote to memory of 4852 2480 chrome.exe 87 PID 2480 wrote to memory of 4852 2480 chrome.exe 87 PID 2480 wrote to memory of 2356 2480 chrome.exe 88 PID 2480 wrote to memory of 2356 2480 chrome.exe 88 PID 2480 wrote to memory of 3644 2480 chrome.exe 90 PID 2480 wrote to memory of 3644 2480 chrome.exe 90 PID 2480 wrote to memory of 1520 2480 chrome.exe 91 PID 2480 wrote to memory of 564 2480 chrome.exe 93 PID 2480 wrote to memory of 564 2480 chrome.exe 93 PID 2480 wrote to memory of 3364 2480 chrome.exe 94 PID 2480 wrote to memory of 1656 2480 chrome.exe 95 PID 2480 wrote to memory of 1172 2480 chrome.exe 96 PID 2480 wrote to memory of 3456 2480 chrome.exe 97 PID 2480 wrote to memory of 3456 2480 chrome.exe 97 PID 2480 wrote to memory of 1252 2480 chrome.exe 98 PID 2480 wrote to memory of 4860 2480 chrome.exe 99 PID 4860 wrote to memory of 4744 4860 run_me.exe 100 PID 4744 wrote to memory of 976 4744 cmd.exe 102 PID 976 wrote to memory of 3836 976 net.exe 103 PID 4744 wrote to memory of 3692 4744 cmd.exe 104 PID 4744 wrote to memory of 2900 4744 cmd.exe 105
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gofile.io/d/XjEDQC1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeea07c728,0x7ffeea07c734,0x7ffeea07c7402⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,3927292144880927024,1346601818226247361,262144 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1872 /prefetch:22⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,8189238042092668834,4051827653085314649,524288 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,2502789004994469243,555389985783768957,524288 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2552 /prefetch:132⤵PID:3232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3100,i,7371946978515129562,18444133410343396399,2097152 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3116,i,13191711974841132748,15981312506493721042,2097152 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,446669272247395511,11899181796296815069,2097152 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4356 /prefetch:92⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4304,i,9852729625093821747,12307641425370263024,2097152 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,201312339991215062,17467337241137348071,524288 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5360 /prefetch:142⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5688,i,9431582268521874240,13770254993509624560,2097152 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:12⤵PID:564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,15286024662212712674,8572816532108501730,524288 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:142⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,1377304888979184670,17012191105553679978,524288 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:142⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,11930873143705218016,14968870002727020577,524288 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5876 /prefetch:142⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4408,i,14392863603138408476,4462147589913458130,2097152 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:12⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,10791840009289319263,9490916264134951553,524288 --field-trial-handle=1876,i,6248294597489528689,6107842723424501833,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5824 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:1252
-
-
C:\Users\Admin\Downloads\run_me.exe"C:\Users\Admin\Downloads\run_me.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E441.tmp\E451.tmp\E452.bat C:\Users\Admin\Downloads\run_me.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\system32\net.exenet user Admin FeetAreMyLife4⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin FeetAreMyLife5⤵PID:3836
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic useraccount where name=???Admin??? rename ???FeetSlut???4⤵PID:3692
-
-
C:\Windows\system32\logoff.exelogoff4⤵PID:2900
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2124
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ec055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1492
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 541f3128bd2c8c288352dad34856b31f4eaf48208c6900b88a8a00207dee79ed
- MD5 2c000b957f07e10db5da82d9a0fa59e9
- SHA1 271bd369984974dd0eb63a89427c3ce541968cf2
- SHA512 0a1e304f9bbdbb588fa2c09ce0fd5a4cd74f8c026b90208e0e97b90b92ea86ac2e2cef272340748e474079d0558c883de1d946d6f4bf75c9c93c74a9256a0eb4
- TLSH T155E02BA6C831EC3B0CFD4B5C7055564EE711135B2780858F363C52098FB167A4296D1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 720B
- SHA256 f952d879626033efb13f899b6f8c8cb384612fddf47086bc9fc5688b68f431ab
- MD5 8723a7c0f64ec1f4d2e738f8629a3d4a
- SHA1 0cd0fc5ceaaa8a2bb075038c9b0d0c9ea08bf4cf
- SHA512 295f4456e8623e5a74f8e9e7ab00dbf6f0ab2bf69bdd0764e26c233b906798cbf364461b944a64977f8c374bb6bca93dbd207b59eb8409977073569a38afa3a5
- TLSH T19D015512BBDAA3FAE3502734F6CBB0A03336872030034F1A2095B1B47825357501F36D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b8e59bba-3926-4290-a650-b040d56e2020.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 17f747f966f0cd2f1741e64af70e0be880407b400a218b79ca1df6ed6d00c215
- MD5 c1a8e9654f3a084ca648d3b97102a942
- SHA1 cfba9cb52913e0dd0bd7ab73451f2176b4e52988
- SHA512 982d466522a9b9697a58b41ac3da1dcbfa8830658616818f9195758b937637f11a758c491a0636e4546f3ee61d793cc380c96c6e0720a4cfa90a416e8da6f711
- SSDEEP 192:RRVCnYO7vNVZ8Rq3/mwE1Dv7H+pAPRp21lVf9WHsb+WNnV8pQVb12VI0kkUOfave:RRIrrZZmBiUXWUwoE2UkLave8e
- TLSH T15942C62EB954793B9CCAC229FA617663E7F5106161E42E84E6F8CA2C15D75CC221702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 7f50ad817bcf43354736f633dc63d385d6c9a4d4ecfebfbad25de81e78525cbc
- MD5 861af43a163980eadd84e7494051dc63
- SHA1 7202b98a10014268d16250161d24ea42ebefe244
- SHA512 31fb8655e7eb7fa07d4a1e3c68678a95dd2b3881e44f611fd1a369e9c460e8c305375bc125a93e2cb75aac9496846eeee6aac63b93d679988651bde835e058de
- SSDEEP 192:RRVCnYOnvNVZ8Rq3/mwEODv7H+pAPRp21lVf9WHsb+WNnV8pQVGkeVh0kkUOfavL:RRIPrZZmYiUXWUwowe5kLavf8E
- TLSH T1C342C53FB910793B9CCAD229FA617763E7F5206161D42E84E6F8CA1C15E75CC221B02B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
- MD5 a6b03dd39d632b77a2b691136935ce1e
- SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
- SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
- SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
- TLSH T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 9a11b4d48089dcac7b352fb2d7ef6c24456b0f2f9956bfae8ae6d361ee8b924f
- MD5 d0802f63724cf9a3e88f51e905b1ea2b
- SHA1 d830f8434dcf6a78bffa14b299ec79d067fd6ecc
- SHA512 64cc7189d8ec8f0ddb32cdc8b37a055499203be612b696ff301a4ec5e82402a03115e5517dcf990439734da2ef9d931e06cb4558459c97be1b091d6d103cf2a8
- TLSH T1F9B0124081015101C0030AF8116224C87214EF34B71B171183E06D268C655628114050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585c63.TMP
- Size 96B
- SHA256 0ca525b4ceb2946db7261babeca11f9f070ba7f6aeb70fbdd04e02d9f1b2e159
- MD5 338dd0bd24b2fdda634aef4f47a549ed
- SHA1 6ec807594313d19a398dd652975f8f96edbb8b0d
- SHA512 3c9de9a3232fd22b30b0370f8ac2b31cb5c8361f33b77991d3d250ea5eb1b54c1266fcd8ebdc63095704799071d1cae9cfe4bded4a5311575d48f92eb3889421
- TLSH T1A6B02208C3022203C00203B028A8E2CEB2B0CF20C2030B0A82E00A2ACC20A200C200B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 7489ad2e65a622f92141a88b0e3125cffff7d7aa8684d6352c2f396b2260eadf
- MD5 8dd843cf5e1474dcbf467ff4836b81b8
- SHA1 e241551127c1aad8cfd7fb7378e0f66f2bece8b9
- SHA512 aab76e9995aa96514b63e090cbf023c2306beac69bf93220d1f77ebf9c047402a44564338c0a026b89153cd136957a9777c712a1af3515cfc6a405f938d8212d
- SSDEEP 3072:hjzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:tWDfxA3OnjrYQ9EU0/hEV
- TLSH T1FBC302A11C39BD660DF8EE98A40D3A60BFF4AC9A92875DD392ED1F4C14FB5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 c25be6fff0fe16767d8cae68b328c4b660f393c495cdb1511221d2b65ef0c54b
- MD5 94c110311d882b7f0342825c09424705
- SHA1 2952a0be470ce434d37482163843da9e5e7bc0f0
- SHA512 70efa7f40db0bfec3cbdd1aac57ea165427ed608da988aeb73934f23582223f890357c7c7fec60794e116abdba47a226a97ed32d54a66841f67abfe608d45988
- SSDEEP 3072:ZzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:9WDfxA3OnjrYQ9EU0/hEV
- TLSH T1C2C302A15C36BD660DF8EE98B40D3A60BFF4AD9A91835DC361ED2F4C24FA5C81139970
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 7d21279ec8e301049aa9c1f6f6083393ca81c374ef96f39f377d2c17d6edc223
- MD5 77596ac5a3d9cf970121f8fccfd28d14
- SHA1 90b157ac3f3429691843264bfe2d6460331ac0a7
- SHA512 b033212dacafb78eb86e3b031d19638f7f9423ff1006e2a632add74f5a896d5a589775b16a2f2f3718c313dacbdc04366507a47e03a6e1d1289540cd2c1f7bcc
- SSDEEP 3072:QjzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:cWDfxA3OnjrYQ9EU0/hEV
- TLSH T16DC302A11C39BD660DF8EE98A40D3A60BFF4AC9A92835DD392ED1F4C14FB5C81179930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\E441.tmp\E451.tmp\E452.bat
- Size 131B
- SHA256 f807dc152a1ee0fa1598a54e15a145758b8a02a32daac03e89813b1667e26fee
- MD5 58b720b5e80e83cb022a471f4770923c
- SHA1 b16faae791610c0ccc84a482e0411ccb95ed46c0
- SHA512 571f17fa5e04cd8511455d0720db29284f22551a62d350fe57e57771f2adec1cae2665a145500c741dbc08ad657a99a801c55878046540487652f6f84340b007
- TLSH T186C09BF6697D045205229D4431D7905531EED1F703C3A1583DF14285D6841899744567
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 651960.crdownload
- Size 290KB
- SHA256 470688413d7e577376d733a2f6684abb65d226656e0611b498bcbd0d9dc5c15f
- MD5 fd9313048c6c38457c54d5a33e4a652d
- SHA1 4d5ba3cf6454b03e52d5951c87fae46502f6fa2a
- SHA512 7a546481346f0b410814db6b111d66d022aa8bd887272a799f1e86dee31d26f867a870fcf0a1578cf45c667f885df5b55ed97f8502b80112abd2baa6215b43b3
- SSDEEP 6144:WbJhs7QW69hd1MMdxPe9N9uA0hu9TBqInhR1Rn+SozRS+LRT6yOgdD1vM3a:WbjDhu9TwIhLhVyRlTxn7Qa
- TLSH T19854DE9BB2D01198DBF442F6D592174AEB7170761B15A3CB6BB853B21B1B4C68F3C3A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\run_me.exe:Zone.Identifier
- Size 153B
- SHA256 ef3b273a300c77b75e10a8a916062d58e488cec47a91ba6efbd50f58437e1d6f
- MD5 6effe7822ed84307b59f7b4339bce858
- SHA1 f1d61b0b395a6be4cb21a039cb1e55a7551fe10c
- SHA512 d3d0b7b18ddac430ed624e48a3a5affa8fbbeeb469c526da6223e726fe2b27c88647ecd3d0cd8f8f7a54321327ec47bc40a8ce74ead3a6059836d294a22db6ea
- TLSH T1FEC08CEB8410B06506082EC0319D40ACF1CF9689C8AD8A08D510405F5A09CF882D4A3B
- MD5 SHA1 SHA512 TLSH