hxxp://gofile[.]io/d/XjEDQC

Analysis

max time kernel
899s
max time network
876s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gofile.io/d/XjEDQC
Sample260701-cpy83aet8x

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	api.gofile.io
15	api.gofile.io
1	api.gofile.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2404	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273463853873435"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
3872	chrome.exe
3872	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe
Token: SeShutdownPrivilege	5328	chrome.exe
Token: SeCreatePagefilePrivilege	5328	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe
5328	chrome.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 2380	5328	chrome.exe	88
PID 5328 wrote to memory of 2312	5328	chrome.exe	89
PID 5328 wrote to memory of 2312	5328	chrome.exe	89
PID 5328 wrote to memory of 2404	5328	chrome.exe	90
PID 5328 wrote to memory of 3272	5328	chrome.exe	91
PID 5328 wrote to memory of 3272	5328	chrome.exe	91
PID 5328 wrote to memory of 4012	5328	chrome.exe	93
PID 5328 wrote to memory of 4012	5328	chrome.exe	93
PID 5328 wrote to memory of 4256	5328	chrome.exe	94
PID 5328 wrote to memory of 4256	5328	chrome.exe	94
PID 5328 wrote to memory of 3932	5328	chrome.exe	95
PID 5328 wrote to memory of 3932	5328	chrome.exe	95
PID 5328 wrote to memory of 4476	5328	chrome.exe	96
PID 5328 wrote to memory of 3908	5328	chrome.exe	98
PID 5328 wrote to memory of 3908	5328	chrome.exe	98
PID 5328 wrote to memory of 3048	5328	chrome.exe	99
PID 5328 wrote to memory of 3048	5328	chrome.exe	99
PID 5328 wrote to memory of 3988	5328	chrome.exe	102
PID 5328 wrote to memory of 3988	5328	chrome.exe	102
PID 5328 wrote to memory of 1232	5328	chrome.exe	103
PID 5328 wrote to memory of 1232	5328	chrome.exe	103
PID 5328 wrote to memory of 2492	5328	chrome.exe	104
PID 5328 wrote to memory of 2492	5328	chrome.exe	104
PID 5328 wrote to memory of 4624	5328	chrome.exe	105
PID 5328 wrote to memory of 4624	5328	chrome.exe	105
PID 5328 wrote to memory of 3400	5328	chrome.exe	106
PID 5328 wrote to memory of 3400	5328	chrome.exe	106
PID 5328 wrote to memory of 1228	5328	chrome.exe	107
PID 5328 wrote to memory of 1228	5328	chrome.exe	107
PID 5328 wrote to memory of 3736	5328	chrome.exe	108
PID 5328 wrote to memory of 3736	5328	chrome.exe	108
PID 5328 wrote to memory of 3464	5328	chrome.exe	110
PID 5328 wrote to memory of 5832	5328	chrome.exe	111
PID 5328 wrote to memory of 6104	5328	chrome.exe	112
PID 5328 wrote to memory of 3872	5328	chrome.exe	113
PID 5328 wrote to memory of 5256	5328	chrome.exe	114
PID 5328 wrote to memory of 5256	5328	chrome.exe	114

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gofile.io/d/XjEDQC
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa4e56c728,0x7ffa4e56c734,0x7ffa4e56c740
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,13089336863200569836,9232015141488441178,262144 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2176,i,9728383525968723936,3335731334023409911,524288 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,6147178251795805601,11911475532111143363,524288 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,2460422501339969389,13473616875480252782,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,18002968767770535257,16407935612822528521,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,6635575855794726208,2054010585648541256,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5192,i,291757196809783458,10381209668926694309,524288 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5304,i,7266972265928236722,4177440565817826280,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5348,i,3349254306622700329,11761114538281321926,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5268,i,17080126208329754692,15306342195256475253,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5600,i,1562366633041776234,4876762577562183501,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5840,i,15392399274703779732,9674437398773502191,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5268,i,3852915965379997772,4394106924678019079,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5404,i,5564811951833688001,17682881610067168796,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5348,i,693938163482205190,4758584242362235998,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5204,i,10390131257949690369,9074853492008979154,2097152 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5968,i,4986291955628488415,6300630815476503204,524288 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,6251885898171238224,1077142315328862436,524288 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,13290513176064691722,8011338841161537738,524288 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4708,i,17660734474097984221,1361704276497697559,262144 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,10951366129749920687,12593670190176997835,524288 --field-trial-handle=1928,i,8933792456228170469,11754649193855787978,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
  2⤵
  PID:5256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6092

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 720B
SHA256 23747379f017f7857b71303c789a341094608fcf04ae452371c15cf50e138126
MD5 041547fba2fa0661ca16cd0d4b1319c2
SHA1 86a10da3b2fc1fd2b90e5e9cd02200a36e8c7238
SHA512 0a404efa210046c881fb3c9d628e5bca46c4e05bf16d32f303d6e5e4c5060d1c70586ca47dedc5edffb2df033ecc6e3cc39b9c71593dece9ba4215e9d082bd76
TLSH
T1D201EC194BA0D2F0D3402A37F2F7A560397212E4300F4F1520418DB0A1D93B73404E6C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 037d58590ac6f72ffc55384520f4fdb84fdad60461f2a790120dc0277babe0f5
MD5 c12f3c0d07f7d9c45402d8c399dfaa57
SHA1 6941c5b3bf19dcaae23b18d10b8b623f49bdf64e
SHA512 8a832d64dd4a3a3dc6894e0e66636ed7a5e8b484d411e30f09bd0c9d02387bdf4a00d0912f4bdbb05534be185d7158ccf60cd559bc097fbc54ea30a7f64dd273
TLSH
T1DB71B8F7C3E8857D891156F9AB116E1FCE6D0914832C3C26C9D4AF0BA3E2971E24068E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0a6baf78fde3d7b8db42f447492cbcea3dce791f7ffcd4cfc7ad48af14fb9b6c
MD5 b0b01c537f3651a60e5751669f5f0a89
SHA1 2c1980793da6e2839e2dae4e2df5444481f07974
SHA512 c8346ad63a254937d4b02ef3e1e42342542f1fdf619f7821a32b3dbef92c797df96ec57c051679710262beac0def020a16bfb707bf24070296f83f18ccb321f2
TLSH
T15571B9F7C3EC857D891156F9AB116E1FCD2D0914832C3C66C9D4AF0BA3E29B1E24068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 ebb11920eebd47672e0266683d434cc788632fc87c29a42df96667422be79f35
MD5 87e22d00d35232e16be7170d465a1a19
SHA1 83918707b8fbc7665b60afb45dcc72bf607cf621
SHA512 53fbb8cc710b82bfdb88fd0f460a4a254a9a229b3efcf8d656cb1e3144c821bff4f6682c24e44f117fbebd0cfb900d4c8985eb769aa8a5842ce6b773b2c65371
TLSH
T1E71172979B7D746B116C587B2E84BC0B587EA831079154F4DE9B813C74816E30F06463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 860e4c65d5322e1f9da977d9d2541839998b1e92a8285351974976357786461f
MD5 4d7c5f1c88ae1f503f1379407d166e75
SHA1 4a7a29c59da8009084441212d28ce1751d332f8e
SHA512 543c3b1aa3f0bf255e0fc963ec1c1a631518bb4f1eba8645392f4a4fe3d00dcc190fe50966bff10d7a9e32e85672563894b43226e78c7d880e33f8e9d7cede8b
SSDEEP 192:tRV8yYZ53qtwpxvv7xAvAPRp2ylVV9lHsb+WNnV4cQV5g2USZeeH+VyIsnAUge:tR/g0GVA6XPfwJr2oe
TLSH
T1D932C42FAE10657F5DCBC269FE71BB63E6F5102161902E44EAFC8A2C21D79DC2217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6f5a92d3aed424c8f5a5bf364badb4263d2b1da271d372dfd2bc335e7bcef403
MD5 ea96648c676e14a5ad60a8ee2b5c7448
SHA1 cfd8e690eb9bc29db701c1e12a4111bbf2804b5d
SHA512 a4ea0bcf1c1d2ec74af143b0208edef3de40d19d842c2cc1bbe11527af877389cdfa596738dd2f6fc57067a8de7d46996d09772b116995331ad3db552ea245bd
SSDEEP 192:tRV8yYZ53qtwpxvv7xAvvqPRpWhylVV9lHsb+WNnV4cQV5g2ULZeeM+VyIsnAUgE:tR/g0GVA8XJfwJr2AE
TLSH
T15642C62FAD10657F5DCBC669FA71BB63E6F1102121902E44EBFC8A2C22D79DC2217027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 31bbb0a62b9dd1893e5d2b5d1895d7c9a2c74dd087acb86bc83e589810dfc1ca
MD5 b4d60461b79774470fab1962e66d7fda
SHA1 b5cacd5acdb8c7c5fc08897d8d035a4820d0766e
SHA512 2f36a56d6ab3da6a942070d305b1780334770491af09f514b61be026a4ec122ff82e78fa8eca591e906cd7e04dad5e4f6a8ca47eb4702d538fbd45f1eeb3e6e7
SSDEEP 192:ecv4K6eE7KxkXqK4I40pUZNCgVLHrKHfFKslETUWXzKD/ls+ErUkKN9ufOvWyN3g:JvjtE7KxkXqKf/pUZNCgVLH2Hfgsl9WJ
TLSH
T1BF32D927A58D9A3F4FD8D51CCD126F4B6DB4029773680924A7FB5C0803E678A124E6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c0ddcdd72841c1620d412cd9441658b6d91cad52dfa8f9cdac35ab5b2fb7882e
MD5 7de76447556e2fe6577795a310899ea7
SHA1 053649cd23f99e55dc9f996f24c38efd93363077
SHA512 01b46bd65b1b632e4a93c22978e5e55645197cade98c5f17e4c5e72e0ad9ea41c88bdeb4422efed15751c7e509c3cdcf2a54e62e811be4814fb297830a437204
SSDEEP 96:AC6cd+geMi2SMvXpgWRXfZowHwzJRDotok5VlfDVYB6yZGyvuttIi+6boiv4a:ACvvTSMXuWRRokoDUDVdVsFEdIi+6boM
TLSH
T1DCA1183195384D7355B6D889BA562B43CFA8712BF6519E94ECDC2F0C22F71BC5382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 e6d703418422f7c4d93bd92d30132b3bd36622164406f99ad601cdc5825b553c
MD5 753aa247a4879b22ffb2db6670f70d8f
SHA1 979e16cc15ffd7f5ffc63ba1020f1d24aa68ee0a
SHA512 0e131a051749c8c395d1c6ca34157105fea6e797af7bf13f987fb0670b7ce5af3bc0e720275e42d253f2f8d8e9a29fdc8394acb60c77916e52f82e4748790fb9
SSDEEP 192:itvvTSMXuWRRokLL5giU2VlVsEwISx5i+buCnIR:itH+MXPR/RglMW7buCna
TLSH
T147D1E771D42D4C7759B6E485B1022E43DEA8716BBA19AE58EDDC1F0C11E35EC9383A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a1c1a7883adad0744b453e6dbdc6f48e14cfecb17762bc298408d2db15faeb57
MD5 4a0b5a4ca67c0b2f9a6f0acbfc33a35f
SHA1 23cc2beb963c7361cce73c0684bb2a5746d61d1d
SHA512 8bb119f85386ebda8c701e31ab22f343a7b5d6b03c3495eed321750372bf604491c7ae9f6fad230d8f8a6db096e8f14fc0918e7728bc2dccfffc517b8e108d6d
SSDEEP 96:iC6cd+geMi2SMvXpgWRXfZowHLL5lzCSl8h4otop5VlbDVYB6hdGyvut4WtXcxwA:iCvvTSMXuWRRokLL5giU2VlVsEwIOcx9
TLSH
T17EC11771E93C9C7366B7A585B5022A43CEB430ABAB549F54E9DD0F0C15E71AC2386A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 1c98c63505c3314b1ab313499b359e4325d6126dbc6b53ef6c8a02533535f168
MD5 cccd30b15288230c5d36c0d0f6e179de
SHA1 a2099aa1853f1b26c06f1a8b3c602bc3bcc0aa56
SHA512 56466d1bb43684e76d1d00c510f06624f7bceaab9ac63deb9218facbcdb3e76868b646d154b84b2f359d02dcede80e4f28b5c6c705183340d91a601e342a6128
SSDEEP 96:ibJ6cd+geMi2SMvXpgWRXfZowHLL5lzCSl8h4otop5VlbDVYB6hdGyvut4WtXcx9:itvvTSMXuWRRokLL5giU2VlVsEwIOcx9
TLSH
T132C12871E93C9C7366B7E585B5022A43CEF430ABAB549F54E9DD0F0C15E71AC2386A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdc0a7a1-a1f1-4418-968f-8c81d0d7dcf8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cdc0a7a1-a1f1-4418-968f-8c81d0d7dcf8.tmp
Size 6KB
SHA256 3c794aebf50337b88f990447533b734439c51cf9305c357d11da11d4163d9092
MD5 d2611ca4b5ef41b20892eb5be023caf2
SHA1 e87f3bc06cc7ee5d1ee6cf95886a2f9a4e492927
SHA512 9584f06ddc772e29a41cdea3bb0398462da917b5e1ca145f688e6bd6e0ef3724409e04615beebb34db5813a22632edbe9423bcd8b422119a4ee4f880e97bf6cf
SSDEEP 192:itvvTSMXuWRRokLL5giU2VlVsEwISx5i+buCnIR:itH+MXPR/RglMW7buCna
TLSH
T1DFC1F771942D4C7749B6E485B1022E43CEA8706BBA19BE58FDDC1F0C12E35EC9383A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download